diff options
| author | roel kluin | 2009-07-25 12:01:50 +0000 |
|---|---|---|
| committer | David S. Miller | 2009-07-26 18:50:38 -0700 |
| commit | 3b73e79b0dcc86f8bec68a34b7fb812eec953f34 (patch) | |
| tree | ea3ebcc267f0ae703bad2e64467c93f75e11b0ce | |
| parent | f83284fe209b1d143244bf462abf1b414eb7b62a (diff) | |
at1700: Read buffer overflow
loop bound looks to be wrong, for an array of length 8
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/at1700.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c index 18b566ad4fd1..cf30e278f182 100644 --- a/drivers/net/at1700.c +++ b/drivers/net/at1700.c @@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr) pos3 = mca_read_stored_pos( slot, 3 ); pos4 = mca_read_stored_pos( slot, 4 ); - for (l_i = 0; l_i < 0x09; l_i++) + for (l_i = 0; l_i < 8; l_i++) if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i]) break; ioaddr = at1700_mca_probe_list[l_i]; |