diff options
| author | Miod Vallat <miod@cvs.openbsd.org> | 2010-09-04 13:14:50 +0000 |
|---|---|---|
| committer | Miod Vallat <miod@cvs.openbsd.org> | 2010-09-04 13:14:50 +0000 |
| commit | 17651e97c25a27eda4592875a08bd4de85c246bc (patch) | |
| tree | a18c61cc29ef7fd6cbd59a7690590f87cda0f5f9 /sys | |
| parent | a25b93cb92f13187627648e9192d926400c83b14 (diff) | |
Off-by-two in the length check for CISTPL_CONFIG tuples.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/pcmcia/pcmcia_cis.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/pcmcia/pcmcia_cis.c b/sys/dev/pcmcia/pcmcia_cis.c index 69abedc8e82..6aa4d8b1063 100644 --- a/sys/dev/pcmcia/pcmcia_cis.c +++ b/sys/dev/pcmcia/pcmcia_cis.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pcmcia_cis.c,v 1.17 2010/09/04 13:13:17 miod Exp $ */ +/* $OpenBSD: pcmcia_cis.c,v 1.18 2010/09/04 13:14:49 miod Exp $ */ /* $NetBSD: pcmcia_cis.c,v 1.9 1998/08/22 23:41:48 msaitoh Exp $ */ /* @@ -926,7 +926,7 @@ pcmcia_parse_cis_tuple(tuple, arg) rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >> PCMCIA_TPCC_RFSZ_SHIFT); - if (tuple->length < (rasz + rmsz + rfsz)) { + if (tuple->length < 2 + rasz + rmsz + rfsz) { DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too " "short %d\n", rasz, rmsz, rfsz, tuple->length)); |