* [PATCH] fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c
@ 2007-11-06 22:57 Roel Kluin
2007-11-06 23:00 ` Al Viro
0 siblings, 1 reply; 3+ messages in thread
From: Roel Kluin @ 2007-11-06 22:57 UTC (permalink / raw)
To: lkml
14 is added as an offset to the array dummy_packet (64 unsigned chars) to
serve as a destination address in a call to memset(). However, when added,
it is automatically scaled by the size of dummy_packet, which is 64. This
results in writing to unintended memory.
Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
---
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index e3dd8b1..1ae0b3e 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -680,7 +680,7 @@ static int eth16i_probe_port(int ioaddr)
dummy_packet[12] = 0x00;
dummy_packet[13] = 0x04;
- memset(dummy_packet + 14, 0, sizeof(dummy_packet) - 14);
+ memset((char *)dummy_packet + 14, 0, sizeof(dummy_packet) - 14);
eth16i_select_regbank(2, ioaddr);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c
2007-11-06 22:57 [PATCH] fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c Roel Kluin
@ 2007-11-06 23:00 ` Al Viro
2007-11-06 23:16 ` Roel Kluin
0 siblings, 1 reply; 3+ messages in thread
From: Al Viro @ 2007-11-06 23:00 UTC (permalink / raw)
To: Roel Kluin; +Cc: lkml
On Tue, Nov 06, 2007 at 11:57:44PM +0100, Roel Kluin wrote:
> 14 is added as an offset to the array dummy_packet (64 unsigned chars) to
> serve as a destination address in a call to memset(). However, when added,
> it is automatically scaled by the size of dummy_packet, which is 64. This
> results in writing to unintended memory.
NAK. Learn C.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c
2007-11-06 23:00 ` Al Viro
@ 2007-11-06 23:16 ` Roel Kluin
0 siblings, 0 replies; 3+ messages in thread
From: Roel Kluin @ 2007-11-06 23:16 UTC (permalink / raw)
To: Al Viro; +Cc: lkml
Al Viro wrote:
> On Tue, Nov 06, 2007 at 11:57:44PM +0100, Roel Kluin wrote:
>> 14 is added as an offset to the array dummy_packet (64 unsigned chars) to
>> serve as a destination address in a call to memset(). However, when added,
>> it is automatically scaled by the size of dummy_packet, which is 64. This
>> results in writing to unintended memory.
>
> NAK. Learn C.
>
yeah I read your other mail, was going to reply myself anyway, but hey, you
had to be rude again.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2007-11-06 23:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-11-06 22:57 [PATCH] fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c Roel Kluin
2007-11-06 23:00 ` Al Viro
2007-11-06 23:16 ` Roel Kluin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox