Cast tmp to u8* instead of void* before pointer arithmetic to allow
the fortified memcpy to correctly bounds-check the access. Using void*
hides the underlying type and triggers:
call to '__read_overflow2_field' declared with 'warning' attribute:
detected read beyond size of field (2nd parameter)
The access is valid: tmp is __be32[17] (68 bytes), and we copy 66 bytes
starting at offset 2.
Fixes: eaa915c7b8da ("firmware: turris-mox-rwtm: add rrpc support")
Assisted-by: Opencode:BigPickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/firmware/turris-mox-rwtm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c
index 1eac9948148f..3a7d960ea480 100644
--- a/drivers/firmware/turris-mox-rwtm.c
+++ b/drivers/firmware/turris-mox-rwtm.c
@@ -286,7 +286,7 @@ static void mox_ecc_number_to_bin(void *dst, const u32 *src)
cpu_to_be32_array(tmp, src, MOX_ECC_NUM_WORDS);
- memcpy(dst, (void *)tmp + 2, MOX_ECC_NUM_LEN);
+ memcpy(dst, (u8 *)tmp + 2, MOX_ECC_NUM_LEN);
}
static void mox_ecc_public_key_to_bin(void *dst, u32 src_first,
--
2.54.0