Skip to content

tmf8829_driver.c:907 array access bug in tmf8829_app_poll_irq_thread #5

@imtjr

Description

@imtjr
static int tmf8829_app_poll_irq_thread(void *tof_chip)
{
    tmf8829_chip *chip = (tmf8829_chip *)tof_chip;
    int us_sleep = 0;
    int period = chip->tof_core.config[TMF8829_CFG_PERIOD_MS_MSB-TMF8829_CFG_PERIOD_MS_LSB] * 256;
    period += chip->tof_core.config[TMF8829_CFG_PERIOD_MS_LSB];
    AMS_MUTEX_LOCK(&chip->lock);

    us_sleep = period * 1000;// Poll period is interpreted in units of 100 usec
    if (us_sleep == 0 ) {
        us_sleep = 10000;
    }
    dev_info(&chip->client->dev, "Starting ToF irq polling thread, period: %u us\n", us_sleep);
    AMS_MUTEX_UNLOCK(&chip->lock);
    while (!kthread_should_stop()) {
        (void) tof_irq_handler(0, tof_chip);
        delayInMicroseconds(us_sleep);
    }
    return 0;
}

The line period += chip->tof_core.config[TMF8829_CFG_PERIOD_MS_LSB]; is incorrect; the array access should be [TMF8829_CFG_PERIOD_MS_LSB-TMF8829_CFG_PERIOD_MS_LSB] or [0] instead.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions