Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b994b5a authored by roel kluin's avatar roel kluin Committed by David S. Miller
Browse files

tulip: Read buffer overflow 



Check whether index is within bounds before testing the element.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 14458630

drivers/net/tulip/de4x5.c

+3 −3
Original line number Diff line number Diff line
@@ -5059,7 +5059,7 @@ mii_get_phy(struct net_device *dev) 
	if ((id == 0) || (id == 65535)) continue;  /* Valid ID? */

	for (j=0; j<limit; j++) {                  /* Search PHY table */

	    if (id != phy_info[j].id) continue;    /* ID match? */

	    for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);

	    for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);

	    if (k < DE4X5_MAX_PHY) {

		memcpy((char *)&lp->phy[k],

		       (char *)&phy_info[j], sizeof(struct phy_table));
@@ -5072,7 +5072,7 @@ mii_get_phy(struct net_device *dev) 
	    break;

	}

	if ((j == limit) && (i < DE4X5_MAX_MII)) {

	    for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);

	    for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);

	    lp->phy[k].addr = i;

	    lp->phy[k].id = id;

	    lp->phy[k].spd.reg = GENERIC_REG;      /* ANLPA register         */
@@ -5091,7 +5091,7 @@ mii_get_phy(struct net_device *dev) 
  purgatory:

    lp->active = 0;

    if (lp->phy[0].id) {                           /* Reset the PHY devices */

	for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++) { /*For each PHY*/

	for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++) { /*For each PHY*/

	    mii_wr(MII_CR_RST, MII_CR, lp->phy[k].addr, DE4X5_MII);

	    while (mii_rd(MII_CR, lp->phy[k].addr, DE4X5_MII) & MII_CR_RST);