mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 01:49:36 +00:00
eexpress: Read buffer overflow
start_code is 69 words, but the code always writes a multiple of 16 words, so the last 11 words written are outside the array. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
a3e8ee6820
commit
f0c5b35c6c
1 changed files with 3 additions and 3 deletions
|
@ -1474,13 +1474,13 @@ static void eexp_hw_init586(struct net_device *dev)
|
|||
outw(0x0000, ioaddr + 0x800c);
|
||||
outw(0x0000, ioaddr + 0x800e);
|
||||
|
||||
for (i = 0; i < (sizeof(start_code)); i+=32) {
|
||||
for (i = 0; i < ARRAY_SIZE(start_code) * 2; i+=32) {
|
||||
int j;
|
||||
outw(i, ioaddr + SM_PTR);
|
||||
for (j = 0; j < 16; j+=2)
|
||||
for (j = 0; j < 16 && (i+j)/2 < ARRAY_SIZE(start_code); j+=2)
|
||||
outw(start_code[(i+j)/2],
|
||||
ioaddr+0x4000+j);
|
||||
for (j = 0; j < 16; j+=2)
|
||||
for (j = 0; j < 16 && (i+j+16)/2 < ARRAY_SIZE(start_code); j+=2)
|
||||
outw(start_code[(i+j+16)/2],
|
||||
ioaddr+0x8000+j);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue