diff options
| author | roel kluin <roel.kluin@gmail.com> | 2009-07-25 16:01:50 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-07-27 05:50:38 +0400 |
| commit | 3b73e79b0dcc86f8bec68a34b7fb812eec953f34 (patch) | |
| tree | ea3ebcc267f0ae703bad2e64467c93f75e11b0ce | |
| parent | f83284fe209b1d143244bf462abf1b414eb7b62a (diff) | |
| download | linux-3b73e79b0dcc86f8bec68a34b7fb812eec953f34.tar.xz | |
at1700: Read buffer overflow
loop bound looks to be wrong, for an array of length 8
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/at1700.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c index 18b566ad4fd1..cf30e278f182 100644 --- a/drivers/net/at1700.c +++ b/drivers/net/at1700.c @@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr) pos3 = mca_read_stored_pos( slot, 3 ); pos4 = mca_read_stored_pos( slot, 4 ); - for (l_i = 0; l_i < 0x09; l_i++) + for (l_i = 0; l_i < 8; l_i++) if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i]) break; ioaddr = at1700_mca_probe_list[l_i]; |