summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarald Welte <laforge@osmocom.org>2020-10-24 12:36:11 +0200
committerHarald Welte <laforge@osmocom.org>2020-10-24 12:37:22 +0200
commit9785a92d66240e7186f3d5e203896908142ed804 (patch)
tree43b4d1e73ec95646d6efead5b2d4f04830d73b7e
parent46cf9b104365842c80f96b6ff8bce90d859b04ed (diff)
tpu: Fix msgb-write-beyond-tailroom in TPU_DEBUGHEADmaster
We need to make sure to allocte sufficient space to include the 32bit frame number at the start of the TPU_DEBUG msgb. Change-Id: Ifb3ce6f91131fc361b20c3b3fe5ebc7079633ac3
-rw-r--r--src/target/firmware/calypso/tpu.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/target/firmware/calypso/tpu.c b/src/target/firmware/calypso/tpu.c
index 0b60292a..f778bfda 100644
--- a/src/target/firmware/calypso/tpu.c
+++ b/src/target/firmware/calypso/tpu.c
@@ -91,7 +91,7 @@ static void tpu_debug(void)
{
uint16_t *tpu_base = (uint16_t *)BASE_ADDR_TPU_RAM;
unsigned int tpu_size = tpu_ptr - tpu_base;
- struct msgb *msg = sercomm_alloc_msgb(tpu_size*2);
+ struct msgb *msg = sercomm_alloc_msgb(sizeof(uint32_t) + tpu_size*2);
uint16_t *data;
uint32_t *fn;
uint16_t reg;