diff options
author | Dominik Brodowski <linux@dominikbrodowski.net> | 2010-08-03 09:33:45 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-08-26 16:41:53 -0700 |
commit | 47084480bf6f0c78be4d3a82020fa18f90425f26 (patch) | |
tree | e6455f8d4b1ca31ce8c8dce32b00b3739615a281 /net/lapb/lapb_in.c | |
parent | 94739dc4e2da1ade4a87b53de97399c2ec0dd83b (diff) |
pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq
commit 127c03cdbad9bd5af5d7f33bd31a1015a90cb77f upstream.
NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in
pcmcia_setup_isa_irq():
static u8 pcmcia_used_irq[NR_IRQS];
...
if ((try < 32) && pcmcia_used_irq[irq])
continue;
This is read-only, so if this address would be non-zero, it would just
mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway!
And as request_irq() fails for an irq >= NR_IRQS, the setting code path:
pcmcia_used_irq[irq]++;
is never reached as well.
Reported-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/lapb/lapb_in.c')
0 files changed, 0 insertions, 0 deletions