Dan Carpenter e15465e180 irda: small read past the end of array in debug code ... The "reason" can come from skb->data[] and it hasn't been capped so it can be from 0-255 instead of just 0-6. For example in irlmp_state_dtr() the code does: reason = skb->data[3]; ... irlmp_disconnect_indication(self, reason, skb); Also LMREASON has a couple other values which don't have entries in the irlmp_reasons[] array. And 0xff is a valid reason as well which means "unknown". So far as I can see we don't actually care about "reason" except for in the debug code. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-04-19 17:32:31 -04:00
..
af_irda.h
crc.h
discovery.h
ircomm_core.h
ircomm_event.h
ircomm_lmp.h
ircomm_param.h
ircomm_ttp.h
ircomm_tty_attach.h
ircomm_tty.h
irda_device.h
irda.h
iriap_event.h
iriap.h
irias_object.h
irlan_client.h
irlan_common.h
irlan_eth.h
irlan_event.h
irlan_filter.h
irlan_provider.h
irlap_event.h
irlap_frame.h
irlap.h
irlmp_event.h
irlmp_frame.h
irlmp.h
irmod.h
irqueue.h
irttp.h
parameters.h
qos.h
timer.h
wrapper.h