Messages in this thread Patch in this message | | | Date | Fri, 07 Aug 2009 17:15:13 +0200 | From | Roel Kluin <> | Subject | [PATCH] sdio: Read buffer overflow |
| |
If the loop breaks with an index of 0, then we read before the array.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com> --- diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c index 963f293..0f8853c 100644 --- a/drivers/mmc/core/sdio_cis.c +++ b/drivers/mmc/core/sdio_cis.c @@ -40,7 +40,7 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func, nr_strings++; } - if (buf[i-1] != '\0') { + if (i != 0 && buf[i-1] != '\0') { printk(KERN_WARNING "SDIO: ignoring broken CISTPL_VERS_1\n"); return 0; }
| |