The Coverity checker noted the following in drivers/net/tg3.c:
<-- snip -->
...
static void __devinit tg3_read_partno(struct tg3 *tp)
{
unsigned char vpd_data[256];
int i;
...
/* Now parse and find the part number. */
for (i = 0; i < 256; ) {
unsigned char val = vpd_data[i];
int block_end;
if (val == 0x82 || val == 0x91) {
i = (i + 3 +
(vpd_data[i + 1] +
(vpd_data[i + 2] << 8)));
continue;
}
if (val != 0x90)
goto out_not_found;
block_end = (i + 3 +
(vpd_data[i + 1] +
(vpd_data[i + 2] << 8)));
i += 3;
...
<-- snip -->
The problem is that vpd_data[i + 2] could be vpd_data[255 + 2].
cu
Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
