lkml.org 
[lkml]   [2009]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] sdio: Read buffer overflow
    If the loop breaks with an index of 0, then we read before the array.

    Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
    ---
    diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
    index 963f293..0f8853c 100644
    --- a/drivers/mmc/core/sdio_cis.c
    +++ b/drivers/mmc/core/sdio_cis.c
    @@ -40,7 +40,7 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
    nr_strings++;
    }

    - if (buf[i-1] != '\0') {
    + if (i != 0 && buf[i-1] != '\0') {
    printk(KERN_WARNING "SDIO: ignoring broken CISTPL_VERS_1\n");
    return 0;
    }

    \
     
     \ /
      Last update: 2009-08-07 17:15    [W:0.020 / U:60.640 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site