Skip to content

Commit

Permalink
tokenring: Read buffer overflow
Browse files Browse the repository at this point in the history
io[i] is read before the bounds check on i, order should be reversed

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
roel kluin authored and David S. Miller committed Jul 27, 2009
1 parent 3b73e79 commit c65d319
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/tokenring/ibmtr.c
Original file line number Diff line number Diff line change
Expand Up @@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)

find_turbo_adapters(io);

for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
struct net_device *dev;
irq[i] = 0;
mem[i] = 0;
Expand Down

0 comments on commit c65d319

Please sign in to comment.