Messages in this thread Patch in this message | | | Subject | [Patch] Possible dereference in drivers/net/wireless/zd1201.c | From | Eric Sesterhenn <> | Date | Sun, 01 Oct 2006 22:27:17 +0200 |
| |
hi,
if we enter the if(!zd) and set free to 1, we dereference zd in the exit code.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.18-git16/drivers/net/wireless/zd1201.c.orig 2006-10-01 22:21:59.000000000 +0200 +++ linux-2.6.18-git16/drivers/net/wireless/zd1201.c 2006-10-01 22:22:59.000000000 +0200 @@ -193,10 +193,8 @@ static void zd1201_usbrx(struct urb *urb struct sk_buff *skb; unsigned char type; - if (!zd) { - free = 1; - goto exit; - } + if (!zd) + return; switch(urb->status) { case -EILSEQ:
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |