[src/netbsd-3]: src/sys/dev/cardbus Pull up following revision(s) (requested ...

[riz <riz%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/080f70f140ce
branches:  netbsd-3
changeset: 577896:080f70f140ce
user:      riz <riz%NetBSD.org@localhost>
date:      Fri Mar 24 22:31:52 2006 +0000

description:
Pull up following revision(s) (requested by drochner in ticket #1214):
        sys/dev/cardbus/cardbus.c: revision 1.65
fix parsing of some informational CIS tuples: correct length and handle
the case correctly where a string is terminated with 0x00 0xff

diffstat:

 sys/dev/cardbus/cardbus.c |  13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diffs (44 lines):

diff -r 186ee66e3d9d -r 080f70f140ce sys/dev/cardbus/cardbus.c
--- a/sys/dev/cardbus/cardbus.c Fri Mar 24 22:28:37 2006 +0000
+++ b/sys/dev/cardbus/cardbus.c Fri Mar 24 22:31:52 2006 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: cardbus.c,v 1.61 2005/02/27 00:26:59 perry Exp $       */
+/*     $NetBSD: cardbus.c,v 1.61.2.1 2006/03/24 22:31:52 riz Exp $     */
 
 /*
  * Copyright (c) 1997, 1998, 1999 and 2000
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cardbus.c,v 1.61 2005/02/27 00:26:59 perry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cardbus.c,v 1.61.2.1 2006/03/24 22:31:52 riz Exp $");
 
 #include "opt_cardbus.h"
 
@@ -293,7 +293,7 @@
 
        switch (tuple[0]) {
        case PCMCIA_CISTPL_MANFID:
-               if (tuple[1] != 5) {
+               if (tuple[1] != 4) {
                        DPRINTF(("%s: wrong length manufacturer id (%d)\n",
                            __func__, tuple[1]));
                        break;
@@ -308,12 +308,13 @@
                p = cis->cis1_info_buf + 2;
                while (i <
                    sizeof(cis->cis1_info) / sizeof(cis->cis1_info[0])) {
+                       if (p >= cis->cis1_info_buf + tuple[1] || *p == '\xff')
+                               break;
                        cis->cis1_info[i++] = p;
                        while (*p != '\0' && *p != '\xff')
                                p++;
-                       if (*p == '\xff')
-                               break;
-                       p++;
+                       if (*p == '\0')
+                               p++;
                }
                break;