diff options
| author |   Roel Kluin <roel.kluin@gmail.com> | 2009-08-08 00:35:31 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-15 12:02:09 -0700 |
| commit | 03cd7136d68b4877a9e1793d31cab38fdcb67434 (patch) | |
| tree | db3e47648bd9ef6492d47e0630ccc639827905b2 /drivers/staging/vt6655 | |
| parent | Staging: vt665x: remove tbit.h part 2 (diff) | |
| download | linux-dev-03cd7136d68b4877a9e1793d31cab38fdcb67434.tar.xz linux-dev-03cd7136d68b4877a9e1793d31cab38fdcb67434.zip | |
Staging: vt6655: fix possible Read buffer overflow
If pDevice->sOpts.nRxDescs{0,1} or nTxDescs[{0,1}] is zero, the loop ends with
i == 0, and we write aRD{0,1}Ring[-1]. apTD{0,1}Rings[-1] respectively.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/vt6655')
| -rw-r--r-- | drivers/staging/vt6655/device_main.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c index 449e47a839d9..53450b48eaa6 100644 --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1400,7 +1400,8 @@ static void device_init_rd0_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc)); } - pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma); + if (i > 0) + pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma); pDevice->pCurrRD[0] = &(pDevice->aRD0Ring[0]); } @@ -1424,7 +1425,8 @@ static void device_init_rd1_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc)); } - pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma); + if (i > 0) + pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma); pDevice->pCurrRD[1] = &(pDevice->aRD1Ring[0]); } @@ -1517,7 +1519,8 @@ static void device_init_td0_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc)); } - pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma); + if (i > 0) + pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma); pDevice->apTailTD[0] = pDevice->apCurrTD[0] =&(pDevice->apTD0Rings[0]); } @@ -1542,7 +1545,8 @@ static void device_init_td1_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc)); } - pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma); + if (i > 0) + pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma); pDevice->apTailTD[1] = pDevice->apCurrTD[1] = &(pDevice->apTD1Rings[0]); } |