diff options
| author | David S. Miller <davem@sunset.davemloft.net> | 2007-10-15 04:36:24 -0400 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-10-15 15:26:31 -0400 |
| commit | e6a5fdf56e3a5fc179cd8c8c19081a9a11882b0c (patch) | |
| tree | 5f3d4a36c55195dae85cb8ddfed416b928bb011c | |
| parent | 65c88466602c61b639f75623e5ba72c1534df9bd (diff) | |
[NIU]: Fix write past end of array in niu_pci_probe_sprom().
Noticed by Coverity checker and reported by Adrian Bunk.
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/niu.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/niu.c b/drivers/net/niu.c index 43bfe7e6b6..54166bdeae 100644 --- a/drivers/net/niu.c +++ b/drivers/net/niu.c | |||
| @@ -6213,7 +6213,7 @@ static int __devinit niu_pci_probe_sprom(struct niu *np) | |||
| 6213 | val = nr64(ESPC_MOD_STR_LEN); | 6213 | val = nr64(ESPC_MOD_STR_LEN); |
| 6214 | niudbg(PROBE, "SPROM: MOD_STR_LEN[%llu]\n", | 6214 | niudbg(PROBE, "SPROM: MOD_STR_LEN[%llu]\n", |
| 6215 | (unsigned long long) val); | 6215 | (unsigned long long) val); |
| 6216 | if (val > 8 * 4) | 6216 | if (val >= 8 * 4) |
| 6217 | return -EINVAL; | 6217 | return -EINVAL; |
| 6218 | 6218 | ||
| 6219 | for (i = 0; i < val; i += 4) { | 6219 | for (i = 0; i < val; i += 4) { |
| @@ -6229,7 +6229,7 @@ static int __devinit niu_pci_probe_sprom(struct niu *np) | |||
| 6229 | val = nr64(ESPC_BD_MOD_STR_LEN); | 6229 | val = nr64(ESPC_BD_MOD_STR_LEN); |
| 6230 | niudbg(PROBE, "SPROM: BD_MOD_STR_LEN[%llu]\n", | 6230 | niudbg(PROBE, "SPROM: BD_MOD_STR_LEN[%llu]\n", |
| 6231 | (unsigned long long) val); | 6231 | (unsigned long long) val); |
| 6232 | if (val > 4 * 4) | 6232 | if (val >= 4 * 4) |
| 6233 | return -EINVAL; | 6233 | return -EINVAL; |
| 6234 | 6234 | ||
| 6235 | for (i = 0; i < val; i += 4) { | 6235 | for (i = 0; i < val; i += 4) { |