diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2013-04-16 21:10:38 +0000 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2013-04-19 17:32:31 -0400 |
| commit | e15465e1808542743627f13d1c0cbb7eacc82b83 (patch) | |
| tree | 498799f640d53224044d5cdcb0463a162d7744a2 /net/sched/cls_fw.c | |
| parent | Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (diff) | |
| download | linux-dev-e15465e1808542743627f13d1c0cbb7eacc82b83.tar.xz linux-dev-e15465e1808542743627f13d1c0cbb7eacc82b83.zip | |
irda: small read past the end of array in debug code
The "reason" can come from skb->data[] and it hasn't been capped so it
can be from 0-255 instead of just 0-6. For example in irlmp_state_dtr()
the code does:
reason = skb->data[3];
...
irlmp_disconnect_indication(self, reason, skb);
Also LMREASON has a couple other values which don't have entries in the
irlmp_reasons[] array. And 0xff is a valid reason as well which means
"unknown".
So far as I can see we don't actually care about "reason" except for in
the debug code.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions