summaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorroel kluin <roel.kluin@gmail.com>2009-07-25 12:01:50 +0000
committerDavid S. Miller <davem@davemloft.net>2009-07-26 18:50:38 -0700
commit3b73e79b0dcc86f8bec68a34b7fb812eec953f34 (patch)
treeea3ebcc267f0ae703bad2e64467c93f75e11b0ce /drivers/net
parentf83284fe209b1d143244bf462abf1b414eb7b62a (diff)
downloadlinux-3b73e79b0dcc86f8bec68a34b7fb812eec953f34.tar.gz
linux-3b73e79b0dcc86f8bec68a34b7fb812eec953f34.tar.bz2
linux-3b73e79b0dcc86f8bec68a34b7fb812eec953f34.zip
at1700: Read buffer overflow
loop bound looks to be wrong, for an array of length 8 Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/at1700.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 18b566ad4fd1..cf30e278f182 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr)
pos3 = mca_read_stored_pos( slot, 3 );
pos4 = mca_read_stored_pos( slot, 4 );
- for (l_i = 0; l_i < 0x09; l_i++)
+ for (l_i = 0; l_i < 8; l_i++)
if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i])
break;
ioaddr = at1700_mca_probe_list[l_i];