Skip to contentSkip to conversation

pcnet32: Read buffer overflow

PATCH Applied Roel Kluin 2 participants 2 messages Aug 7, 2009 – Aug 10, 2009

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 pcnet32: Read buffer overflow

An options[cards_found]' that equals sizeof(options_mapping)' is already beyond the array.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/net/pcnet32.c +1 -1
index 2836815..7f834a3 100644
@@ -1835,7 +1835,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 	lp->chip_version = chip_version;
 	lp->msg_enable = pcnet32_debug;
 	if ((cards_found >= MAX_UNITS)
-	    || (options[cards_found] > sizeof(options_mapping)))
+	    || (options[cards_found] >= sizeof(options_mapping)))
 		lp->options = PCNET32_PORT_ASEL;
 	else
 		lp->options = options_mapping[options[cards_found]];