* [PATCH] cyclades: Read buffer overflow
@ 2009-07-25 22:59 Roel Kluin
0 siblings, 0 replies; only message in thread
From: Roel Kluin @ 2009-07-25 22:59 UTC (permalink / raw)
To: LKML, Andrew Morton
irq is declared with size NR_CARDS (4), but the loop containing this segment
runs up until NR_ISA_ADDRS (16), possibly reading from irq[i] (and trying to
use the result)
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
Credits to Parfait
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index 2dafc2d..d067705 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -4535,7 +4535,7 @@ static int __init cy_detect_isa(void)
continue;
}
#ifdef MODULE
- if (isparam && irq[i])
+ if (isparam && i < NR_CARDS && irq[i])
cy_isa_irq = irq[i];
else
#endif
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2009-07-25 22:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-25 22:59 [PATCH] cyclades: Read buffer overflow Roel Kluin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.