Dan Carpenter e15465e180 irda: small read past the end of array in debug code ... The "reason" can come from skb->data[] and it hasn't been capped so it can be from 0-255 instead of just 0-6. For example in irlmp_state_dtr() the code does: reason = skb->data[3]; ... irlmp_disconnect_indication(self, reason, skb); Also LMREASON has a couple other values which don't have entries in the irlmp_reasons[] array. And 0xff is a valid reason as well which means "unknown". So far as I can see we don't actually care about "reason" except for in the debug code. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-04-19 17:32:31 -04:00
..
ircomm	net/irda: Raise dtr in non-blocking open	2013-03-06 02:47:05 -05:00
irlan
irnet	irda: buffer overflow in irnet_ctrl_read()	2013-01-27 20:38:19 -05:00
af_irda.c	irda: Fix missing msg_namelen update in irda_recvmsg_dgram()	2013-04-07 16:28:01 -04:00
discovery.c
irda_device.c
iriap_event.c
iriap.c	irda: small read past the end of array in debug code	2013-04-19 17:32:31 -04:00
irias_object.c
irlap_event.c
irlap_frame.c
irlap.c
irlmp_event.c
irlmp_frame.c
irlmp.c	irda: small read past the end of array in debug code	2013-04-19 17:32:31 -04:00
irmod.c
irnetlink.c
irproc.c
irqueue.c
irsysctl.c
irttp.c	irda: irttp: fix memory leak in irttp_open_tsap() error path	2012-11-28 11:25:29 -05:00
Kconfig
Makefile
parameters.c
qos.c
timer.c	treewide: Replace incomming with incoming in all comments and strings	2013-01-03 16:15:49 +01:00
wrapper.c