* [PATCH] cyclades: Read buffer overflow
@ 2009-07-25 22:59 Roel Kluin
0 siblings, 0 replies; only message in thread
From: Roel Kluin @ 2009-07-25 22:59 UTC (permalink / raw)
To: LKML, Andrew Morton
irq is declared with size NR_CARDS (4), but the loop containing this segment
runs up until NR_ISA_ADDRS (16), possibly reading from irq[i] (and trying to
use the result)
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
Credits to Parfait
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index 2dafc2d..d067705 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -4535,7 +4535,7 @@ static int __init cy_detect_isa(void)
continue;
}
#ifdef MODULE
- if (isparam && irq[i])
+ if (isparam && i < NR_CARDS && irq[i])
cy_isa_irq = irq[i];
else
#endif
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2009-07-25 22:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-25 22:59 [PATCH] cyclades: Read buffer overflow Roel Kluin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox