From 801fcfc07ce3cee36ce8c16e8e4fa26d22ae8db3 Mon Sep 17 00:00:00 2001 From: Daniel Drake Date: Tue, 16 Oct 2007 14:34:47 +0100 Subject: [PATCH] upekts: fix memory corruption Found by valgrind --- libfprint/drivers/upekts.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libfprint/drivers/upekts.c b/libfprint/drivers/upekts.c index f1ddad46..2724a17f 100644 --- a/libfprint/drivers/upekts.c +++ b/libfprint/drivers/upekts.c @@ -177,6 +177,7 @@ static int send_cmd(struct fp_dev *dev, unsigned char seq_a, static int send_cmd28(struct fp_dev *dev, unsigned char subcmd, unsigned char *data, uint16_t innerlen) { + uint16_t _innerlen = innerlen; size_t len = innerlen + 6; unsigned char *buf = g_malloc0(len); struct upekts_dev *upekdev = dev->priv; @@ -185,10 +186,10 @@ static int send_cmd28(struct fp_dev *dev, unsigned char subcmd, fp_dbg("seq=%02x subcmd=%02x with %d bytes of data", seq, subcmd, innerlen); - innerlen = cpu_to_le16(innerlen + 3); + _innerlen = cpu_to_le16(innerlen + 3); buf[0] = 0x28; - buf[1] = innerlen & 0x00ff; - buf[2] = (innerlen & 0xff00) >> 8; + buf[1] = _innerlen & 0x00ff; + buf[2] = (_innerlen & 0xff00) >> 8; buf[5] = subcmd; memcpy(buf + 6, data, innerlen);