summaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorLukasz Majewski <l.majewski@samsung.com>2013-06-26 11:46:13 +0200
committerMarek Vasut <marex@denx.de>2013-06-30 18:41:08 +0200
commite059a400ad780328cd5ad22c396298cac520c856 (patch)
tree8576ec1b6d6b7287a9a2ef05e8f3454a7f3236d1 /drivers/usb
parent7a3427854243f0e28c102926d203709b3e3cee62 (diff)
dfu:function: Fix number of allocated DFU function pointers
This subtle change fix problem with too small amount of allocated memory to store DFU function pointers. One needs to allocate extra space for sentinel NULL pointer in this array of function pointers. With the previous code, the NULL value overwrites malloc internal data and afterwards free(f_dfu->function) crashes. Signed-off-by: Lukasz Majewski <l.majewski@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Cc: Marek Vasut <marex@denx.de>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/gadget/f_dfu.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 178a0044c4..e3fa0e373d 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -589,7 +589,7 @@ static int dfu_prepare_function(struct f_dfu *f_dfu, int n)
struct usb_interface_descriptor *d;
int i = 0;
- f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n);
+ f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 1);
if (!f_dfu->function)
goto enomem;