Hi,
buffer overflow in next-tree's commit 810654b4119fd8c6ce03ffeb4b78f0ff8ffe0559
drivers/pcmcia/ds.c
555 for (i = 0; i < (MAX_IO_WIN + MAX_WIN); i++) {
556 c->io[i].name = p_dev->devname;
with 'io' only defined to MAX_IO_WIN
drivers/pcmcia/cs_internal.h
42 struct resource io[MAX_IO_WIN]; /* io ports */
non-tested fix:
diff --git a/drivers/pcmcia/cs_internal.h b/drivers/pcmcia/cs_internal.h
index da055dc..d14c6ec 100644
--- a/drivers/pcmcia/cs_internal.h
+++ b/drivers/pcmcia/cs_internal.h
@@ -39,7 +39,7 @@ typedef struct config_t {
unsigned char Status, Pin, Copy, Option, ExtStatus;
unsigned int CardValues;
- struct resource io[MAX_IO_WIN]; /* io ports */
+ struct resource io[MAX_IO_WIN + MAX_WIN]; /* io ports */
struct resource mem[MAX_WIN]; /* mem areas */
struct {
--
To unsubscribe from this list: send the line "unsubscribe linux-next" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
