From: Gustavo A. R. Silva Date: Wed, 29 Jul 2020 23:35:57 +0000 (-0500) Subject: staging: wfx: Use flex_array_size() helper in memcpy() X-Git-Tag: v5.9-rc1~119^2~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3e1f8882a9f2a792f2627e7aac711d42bc809afe;p=thirdparty%2Fkernel%2Flinux.git staging: wfx: Use flex_array_size() helper in memcpy() Make use of the flex_array_size() helper to calculate the size of a flexible array member within an enclosing structure. This helper offers defense-in-depth against potential integer overflows, while at the same time makes it explicitly clear that we are dealing with a flexible array member. Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200729233557.GA17693@embeddedor Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/wfx/hif_tx_mib.c b/drivers/staging/wfx/hif_tx_mib.c index 1689cb42acc0d..05f1e1e98af9e 100644 --- a/drivers/staging/wfx/hif_tx_mib.c +++ b/drivers/staging/wfx/hif_tx_mib.c @@ -113,7 +113,7 @@ int hif_set_beacon_filter_table(struct wfx_vif *wvif, int tbl_len, if (!val) return -ENOMEM; val->num_of_info_elmts = cpu_to_le32(tbl_len); - memcpy(val->ie_table, tbl, tbl_len * sizeof(*tbl)); + memcpy(val->ie_table, tbl, flex_array_size(val, ie_table, tbl_len)); ret = hif_write_mib(wvif->wdev, wvif->id, HIF_MIB_ID_BEACON_FILTER_TABLE, val, buf_len); kfree(val);