提交 c65d3198 编写于 作者: R roel kluin 提交者: David S. Miller

tokenring: Read buffer overflow

io[i] is read before the bounds check on i, order should be reversed
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 3b73e79b
...@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void) ...@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
find_turbo_adapters(io); find_turbo_adapters(io);
for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) { for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
struct net_device *dev; struct net_device *dev;
irq[i] = 0; irq[i] = 0;
mem[i] = 0; mem[i] = 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册