Skip to contentSkip to conversation

fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c

PATCH In review Roel Kluin 2 participants 3 messages Nov 6, 2007 Network drivers

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 fix writing to unintended memory in eth16i_probe_port(); drivers/net/eth16i.c

14 is added as an offset to the array dummy_packet (64 unsigned chars) to serve as a destination address in a call to memset(). However, when added, it is automatically scaled by the size of dummy_packet, which is 64. This results in writing to unintended memory.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/net/eth16i.c +1 -1
index e3dd8b1..1ae0b3e 100644
@@ -680,7 +680,7 @@ static int eth16i_probe_port(int ioaddr)
 
 	dummy_packet[12] = 0x00;
 	dummy_packet[13] = 0x04;
-	memset(dummy_packet + 14, 0, sizeof(dummy_packet) - 14);
+	memset((char *)dummy_packet + 14, 0, sizeof(dummy_packet) - 14);
 
 	eth16i_select_regbank(2, ioaddr);
#1 lore raw
Quoted 4 lines · Roel Kluin

14 is added as an offset to the array dummy_packet (64 unsigned chars) to serve as a destination address in a call to memset(). However, when added, it is automatically scaled by the size of dummy_packet, which is 64. This results in writing to unintended memory.

NAK. Learn C.

author
#2 lore raw
Quoted 8 lines · Al Viro
Quoted 4 lines · Roel Kluin

14 is added as an offset to the array dummy_packet (64 unsigned chars) to serve as a destination address in a call to memset(). However, when added, it is automatically scaled by the size of dummy_packet, which is 64. This results in writing to unintended memory.

NAK. Learn C.

yeah I read your other mail, was going to reply myself anyway, but hey, you had to be rude again.