Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18eb0893 authored by roel kluin's avatar roel kluin Committed by David S. Miller
Browse files

ibmtr: possible Read buffer overflow? 



Prevent read outside array bounds.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b0c110ca

drivers/net/tokenring/ibmtr.c

+9 −2
Original line number Diff line number Diff line
@@ -1143,9 +1143,16 @@ static void dir_open_adapter (struct net_device *dev) 
                } else {

			char **prphase = printphase;

			char **prerror = printerror;

			int pnr = err / 16 - 1;

			int enr = err % 16 - 1;

			DPRINTK("TR Adapter misc open failure, error code = ");

			printk("0x%x, Phase: %s, Error: %s\n",

				err, prphase[err/16 -1], prerror[err%16 -1]);

			if (pnr < 0 || pnr >= ARRAY_SIZE(printphase) ||

					enr < 0 ||

					enr >= ARRAY_SIZE(printerror))

				printk("0x%x, invalid Phase/Error.", err);

			else

				printk("0x%x, Phase: %s, Error: %s\n", err,

						prphase[pnr], prerror[enr]);

			printk(" retrying after %ds delay...\n",

					TR_RETRY_INTERVAL/HZ);

                }