From: Roel Kluin <roel.kluin@xxxxxxxxx> irq is declared with size NR_CARDS (4), but the loop containing this segment runs up until NR_ISA_ADDRS (16), possibly reading from irq[i] (and trying to use the result) Identified by the Parfait static scanner. Signed-off-by: Roel Kluin <roel.kluin@xxxxxxxxx> Acked-by: Jiri Slaby <jirislaby@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/char/cyclades.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN drivers/char/cyclades.c~cyclades-read-buffer-overflow drivers/char/cyclades.c --- a/drivers/char/cyclades.c~cyclades-read-buffer-overflow +++ a/drivers/char/cyclades.c @@ -3354,7 +3354,7 @@ static int __init cy_detect_isa(void) continue; } #ifdef MODULE - if (isparam && irq[i]) + if (isparam && i < NR_CARDS && irq[i]) cy_isa_irq = irq[i]; else #endif _ -- To unsubscribe from this list: send the line "unsubscribe linux-serial" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
