From patchwork Mon Aug 3 12:41:42 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: roel kluin X-Patchwork-Id: 30501 X-Patchwork-Delegate: benh@kernel.crashing.org Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id F0D53B6F34 for ; Mon, 3 Aug 2009 22:39:00 +1000 (EST) Received: by ozlabs.org (Postfix) id E5717DDDA2; Mon, 3 Aug 2009 22:39:00 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from bilbo.ozlabs.org (bilbo.ozlabs.org [203.10.76.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "bilbo.ozlabs.org", Issuer "CAcert Class 3 Root" (verified OK)) by ozlabs.org (Postfix) with ESMTPS id E3C8EDDDA0 for ; Mon, 3 Aug 2009 22:39:00 +1000 (EST) Received: from bilbo.ozlabs.org (localhost [127.0.0.1]) by bilbo.ozlabs.org (Postfix) with ESMTP id 9CFC6B7DE2 for ; Mon, 3 Aug 2009 22:38:38 +1000 (EST) Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id 0040BB6F31 for ; Mon, 3 Aug 2009 22:38:33 +1000 (EST) Received: by ozlabs.org (Postfix) id E65DCDDDA2; Mon, 3 Aug 2009 22:38:32 +1000 (EST) Delivered-To: linuxppc-dev@ozlabs.org Received: from mail-ew0-f225.google.com (mail-ew0-f225.google.com [209.85.219.225]) by ozlabs.org (Postfix) with ESMTP id 3400ADDD1B for ; Mon, 3 Aug 2009 22:38:30 +1000 (EST) Received: by ewy25 with SMTP id 25so967563ewy.9 for ; Mon, 03 Aug 2009 05:38:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=S70065obwr5KlnEwc0NxRXSKz26m/GdGG2i1ml09Dbs=; b=VtzHQLwo3IHiubm2ftSMUpQGr+vP2BROOYRvObm5M2rk804jYEoptZQBRkoTQvv83e KWU4aM4JJDAGBR8siztdak2fDclL38HiZPwxA6y3NYu5KydnDehX2PMiNvbHNkbaqPZf zUcxwMoE3yYQ4O40gZK/aacQ5/1yEMHdmXmrg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=OlXU8XxmBZdvh+taLZ3g4A2EMjSBFgBIBTuY1wSjmTYZkawhe2bEy0n6zOCABmcutU AIlFGbZc9nciR3tfPh5I7ZnUFLrm852+kEHK4BZ57CKUvb1Pyq8EzQrt5Rh329+okqIh +v07Mz6G/JCUB+0AUK7/qwNuPqohRSuzxJCuo= Received: by 10.211.180.15 with SMTP id h15mr7249236ebp.28.1249303107369; Mon, 03 Aug 2009 05:38:27 -0700 (PDT) Received: from zoinx.mars (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 7sm12441363eyg.55.2009.08.03.05.38.25 (version=SSLv3 cipher=RC4-MD5); Mon, 03 Aug 2009 05:38:26 -0700 (PDT) Message-ID: <4A76DB06.7090405@gmail.com> Date: Mon, 03 Aug 2009 14:41:42 +0200 From: Roel Kluin User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2 MIME-Version: 1.0 To: Andrew Morton , linuxppc-dev@ozlabs.org, benh@kernel.crashing.org Subject: [PATCH] powerpc: Read buffer overflow X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Errors-To: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Check whether index is within bounds before grabbing the element. Signed-off-by: Roel Kluin diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c index a0f6838..588a5b0 100644 --- a/drivers/macintosh/macio_asic.c +++ b/drivers/macintosh/macio_asic.c @@ -294,10 +294,11 @@ static void macio_setup_interrupts(struct macio_dev *dev) int i = 0, j = 0; for (;;) { - struct resource *res = &dev->interrupt[j]; + struct resource *res; if (j >= MACIO_DEV_COUNT_IRQS) break; + res = &dev->interrupt[j]; irq = irq_of_parse_and_map(np, i++); if (irq == NO_IRQ) break; @@ -321,9 +322,10 @@ static void macio_setup_resources(struct macio_dev *dev, int index; for (index = 0; of_address_to_resource(np, index, &r) == 0; index++) { - struct resource *res = &dev->resource[index]; + struct resource *res; if (index >= MACIO_DEV_COUNT_RESOURCES) break; + res = &dev->resource[index]; *res = r; res->name = dev_name(&dev->ofdev.dev);