diff options
| author |   miod <miod@openbsd.org> | 2010-09-04 13:14:49 +0000 |
|---|---|---|
| committer | miod <miod@openbsd.org> | 2010-09-04 13:14:49 +0000 |
| commit | 1ac9a5357112bc165d282670e8a1674a0964daa2 (patch) | |
| tree | e7180ac3b6f03049db4ff1ab168b421826d4bbd9 | |
| parent | Use pcmcia_cis_read_1() to read cis data to be checksummed, instead of (diff) | |
| download | wireguard-openbsd-1ac9a5357112bc165d282670e8a1674a0964daa2.tar.xz wireguard-openbsd-1ac9a5357112bc165d282670e8a1674a0964daa2.zip | |
Off-by-two in the length check for CISTPL_CONFIG tuples.
| -rw-r--r-- | sys/dev/pcmcia/pcmcia_cis.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/pcmcia/pcmcia_cis.c b/sys/dev/pcmcia/pcmcia_cis.c index 69abedc8e82..6aa4d8b1063 100644 --- a/sys/dev/pcmcia/pcmcia_cis.c +++ b/sys/dev/pcmcia/pcmcia_cis.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pcmcia_cis.c,v 1.17 2010/09/04 13:13:17 miod Exp $ */ +/* $OpenBSD: pcmcia_cis.c,v 1.18 2010/09/04 13:14:49 miod Exp $ */ /* $NetBSD: pcmcia_cis.c,v 1.9 1998/08/22 23:41:48 msaitoh Exp $ */ /* @@ -926,7 +926,7 @@ pcmcia_parse_cis_tuple(tuple, arg) rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >> PCMCIA_TPCC_RFSZ_SHIFT); - if (tuple->length < (rasz + rmsz + rfsz)) { + if (tuple->length < 2 + rasz + rmsz + rfsz) { DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too " "short %d\n", rasz, rmsz, rfsz, tuple->length)); |