diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-10-15 05:42:00 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-10-15 12:24:38 -0700 |
| commit | fcbf77bf872c28ac3f18261a44af91383f0a2f3d (patch) | |
| tree | 2fc58c37a0684b142b9758e4457f40dcdfc0c607 /net/lapb/lapb_in.c | |
| parent | 4073f1b6ab9c70d603b194b1bb415b9e742b245f (diff) | |
Staging: ft1000-usb: fix array overflow
The code here is supposed checking if we exited the loop without hitting
a break. The problem is that in the error handling "i" is out of bounds
and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++.
>From the comments, it looks like someone noticed this corruption and
updated the code, but didn't totally fix the problem. The correct fix
is just to remove nRxMsgMiss++ from the error path.
I believe this bug can be triggered remotely.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/lapb/lapb_in.c')
0 files changed, 0 insertions, 0 deletions