diff options
| author | roel kluin <roel.kluin@gmail.com> | 2009-07-25 14:01:50 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-07-27 03:50:38 +0200 |
| commit | 3b73e79b0dcc86f8bec68a34b7fb812eec953f34 (patch) | |
| tree | ea3ebcc267f0ae703bad2e64467c93f75e11b0ce /drivers/net/at1700.c | |
| parent | fealnx: Write outside array bounds (diff) | |
| download | linux-3b73e79b0dcc86f8bec68a34b7fb812eec953f34.tar.xz linux-3b73e79b0dcc86f8bec68a34b7fb812eec953f34.zip | |
at1700: Read buffer overflow
loop bound looks to be wrong, for an array of length 8
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/at1700.c')
| -rw-r--r-- | drivers/net/at1700.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c index 18b566ad4fd1..cf30e278f182 100644 --- a/drivers/net/at1700.c +++ b/drivers/net/at1700.c @@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr) pos3 = mca_read_stored_pos( slot, 3 ); pos4 = mca_read_stored_pos( slot, 4 ); - for (l_i = 0; l_i < 0x09; l_i++) + for (l_i = 0; l_i < 8; l_i++) if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i]) break; ioaddr = at1700_mca_probe_list[l_i]; |