[Patch] Array overrun in drivers/net/tokenring/3c359.c

hi,

this was spotted by coverity (#id 502)
the xl_laa[] array has only 6 entries, since the else
case uses i-10 as array index to dev->dev_addr[] i guess
thats what should be done here too

Signed-off-by: Eric Sesterhenn <[email protected]>

--- linux-2.6.17-git2/drivers/net/tokenring/3c359.c.orig	2006-06-21 16:31:36.000000000 +0200
+++ linux-2.6.17-git2/drivers/net/tokenring/3c359.c	2006-06-21 16:31:41.000000000 +0200
@@ -764,7 +764,7 @@ static int xl_open_hw(struct net_device 
 	if (xl_priv->xl_laa[0]) {  /* If using a LAA address */
 		for (i=10;i<16;i++) { 
 			writel( (MEM_BYTE_WRITE | 0xD0000 | xl_priv->srb) + i, xl_mmio + MMIO_MAC_ACCESS_CMD) ; 
-			writeb(xl_priv->xl_laa[i],xl_mmio + MMIO_MACDATA) ; 
+			writeb(xl_priv->xl_laa[i-10],xl_mmio + MMIO_MACDATA) ; 
 		}
 		memcpy(dev->dev_addr,xl_priv->xl_laa,dev->addr_len) ; 
 	} else { /* Regular hardware address */ 


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Prev by Date: [PATCH 09/21] [MMC] Fix sdhci PIO routines
• Next by Date: Re: gcc-4.1.1 and kernel-2.4.32
• Previous by thread: [PATCH] add synclink_gt crc return feature
• Next by thread: [PATCH] fix synclink_gt diagnostics error reporting
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]