[Patch] Array overrun in drivers/net/tokenring/3c359.c

[Eric Sesterhenn]

hi,

this was spotted by coverity (#id 502)
the xl_laa[] array has only 6 entries, since the else
case uses i-10 as array index to dev->dev_addr[] i guess
thats what should be done here too

Signed-off-by: Eric Sesterhenn <snakebyte@xxxxxx>

--- linux-2.6.17-git2/drivers/net/tokenring/3c359.c.orig	2006-06-21 16:31:36.000000000 +0200
+++ linux-2.6.17-git2/drivers/net/tokenring/3c359.c	2006-06-21 16:31:41.000000000 +0200
@@ -764,7 +764,7 @@ static int xl_open_hw(struct net_device 
 	if (xl_priv->xl_laa[0]) {  /* If using a LAA address */
 		for (i=10;i<16;i++) { 
 			writel( (MEM_BYTE_WRITE | 0xD0000 | xl_priv->srb) + i, xl_mmio + MMIO_MAC_ACCESS_CMD) ; 
-			writeb(xl_priv->xl_laa[i],xl_mmio + MMIO_MACDATA) ; 
+			writeb(xl_priv->xl_laa[i-10],xl_mmio + MMIO_MACDATA) ; 
 		}
 		memcpy(dev->dev_addr,xl_priv->xl_laa,dev->addr_len) ; 
 	} else { /* Regular hardware address */ 


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/