2a0ebf80aa
The value of "offd" comes off the instance->rcv_buf[] and we used it as the offset into an array. The problem is that we check the upper bound but not for negative values. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| cxacru.c | ||
| Kconfig | ||
| Makefile | ||
| speedtch.c | ||
| ueagle-atm.c | ||
| usbatm.c | ||
| usbatm.h | ||
| xusbatm.c | ||