[PATCH] staging: bcm: Fix out of bounds access in CmHosts.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



An array u8IPv6FlowLable[] is defined as 3 in cntrl_SignalingInterface.h.
But in CmHosts.c, the kernel accessed to clsRule.u8IPv6FlowLable[5].

Signed-off-by: Masanari Iida <standby24x7@xxxxxxxxx>
---
 drivers/staging/bcm/cntrl_SignalingInterface.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/bcm/cntrl_SignalingInterface.h b/drivers/staging/bcm/cntrl_SignalingInterface.h
index 8683c2d..122235d 100644
--- a/drivers/staging/bcm/cntrl_SignalingInterface.h
+++ b/drivers/staging/bcm/cntrl_SignalingInterface.h
@@ -32,7 +32,7 @@
 #define ETHERNET_DEST_MAC_ADDR_LENGTH	12
 #define ETHERNET_SRC_MAC_ADDR_LENGTH	12
 #define NUM_ETHERTYPE_BYTES		3
-#define NUM_IPV6_FLOWLABLE_BYTES	3
+#define NUM_IPV6_FLOWLABLE_BYTES	6
 
 struct bcm_packet_class_rules {
 	/* 16bit UserPriority Of The Service Flow */
-- 
2.0.0.rc4.1.g4a28f16

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel




[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux