MTD: Fix bug in fixup_convert_atmel_pri

[Linux-MTD Mailing List]

Commit:     de591dacf3034977b3fb94b61d08240c8b35c39d
Parent:     d882687c51b52424a56992578ce7636b3f3c8d41
commit de591dacf3034977b3fb94b61d08240c8b35c39d
Author:     Håvard Skinnemoen <hskinnemoen at atmel.com>
AuthorDate: Fri Sep 15 17:19:31 2006 +0200
Commit:     David Woodhouse <dwmw2 at infradead.org>
CommitDate: Sat Sep 16 13:54:17 2006 +0100

    MTD: Fix bug in fixup_convert_atmel_pri
    
    The memset() in fixup_convert_atmel_pri is supposed to zero out
    everything except the first 5 bytes in *extp, but it ends up zeroing
    out something way outside the struct instead. Fix this potentially
    dangerous code by casting the pointer to char * before doing
    arithmetic.
    
    Signed-off-by: Håvard Skinnemoen <hskinnemoen at atmel.com>
    Signed-off-by: David Woodhouse <dwmw2 at infradead.org>
---
 drivers/mtd/chips/cfi_cmdset_0002.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index ddc5bd7..a482e89 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -175,7 +175,7 @@ static void fixup_convert_atmel_pri(stru
 	struct cfi_pri_atmel atmel_pri;
 
 	memcpy(&atmel_pri, extp, sizeof(atmel_pri));
-	memset(extp + 5, 0, sizeof(*extp) - 5);
+	memset((char *)extp + 5, 0, sizeof(*extp) - 5);
 
 	if (atmel_pri.Features & 0x02)
 		extp->EraseSuspend = 2;