mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 01:49:36 +00:00
pcnet32: Read buffer overflow
An `options[cards_found]' that equals `sizeof(options_mapping)' is already beyond the array. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
418372b0ab
commit
5e33b719c8
1 changed files with 1 additions and 1 deletions
|
@ -1839,7 +1839,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
|
|||
lp->chip_version = chip_version;
|
||||
lp->msg_enable = pcnet32_debug;
|
||||
if ((cards_found >= MAX_UNITS)
|
||||
|| (options[cards_found] > sizeof(options_mapping)))
|
||||
|| (options[cards_found] >= sizeof(options_mapping)))
|
||||
lp->options = PCNET32_PORT_ASEL;
|
||||
else
|
||||
lp->options = options_mapping[options[cards_found]];
|
||||
|
|
Loading…
Reference in a new issue