The Coverity checker noted the following in drivers/net/tg3.c: <-- snip -->
... static void __devinit tg3_read_partno(struct tg3 *tp) { unsigned char vpd_data[256]; int i; ... /* Now parse and find the part number. */ for (i = 0; i < 256; ) { unsigned char val = vpd_data[i]; int block_end; if (val == 0x82 || val == 0x91) { i = (i + 3 + (vpd_data[i + 1] + (vpd_data[i + 2] << 8))); continue; } if (val != 0x90) goto out_not_found; block_end = (i + 3 + (vpd_data[i + 1] + (vpd_data[i + 2] << 8))); i += 3; ... <-- snip --> The problem is that vpd_data[i + 2] could be vpd_data[255 + 2]. cu Adrian -- "Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html