[src/trunk]: src/sys/dev/cardbus fix parsing of some informational CIS tuples...

[drochner <drochner%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/eea99699485f
branches:  trunk
changeset: 584097:eea99699485f
user:      drochner <drochner%NetBSD.org@localhost>
date:      Thu Sep 08 15:02:48 2005 +0000

description:
fix parsing of some informational CIS tuples: correct length and handle
the case correctly where a string is terminated with 0x00 0xff

diffstat:

 sys/dev/cardbus/cardbus.c |  13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diffs (44 lines):

diff -r 96233ae3208b -r eea99699485f sys/dev/cardbus/cardbus.c
--- a/sys/dev/cardbus/cardbus.c Thu Sep 08 14:58:14 2005 +0000
+++ b/sys/dev/cardbus/cardbus.c Thu Sep 08 15:02:48 2005 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: cardbus.c,v 1.64 2005/08/26 11:01:42 drochner Exp $    */
+/*     $NetBSD: cardbus.c,v 1.65 2005/09/08 15:02:48 drochner Exp $    */
 
 /*
  * Copyright (c) 1997, 1998, 1999 and 2000
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cardbus.c,v 1.64 2005/08/26 11:01:42 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cardbus.c,v 1.65 2005/09/08 15:02:48 drochner Exp $");
 
 #include "opt_cardbus.h"
 
@@ -291,7 +291,7 @@
 
        switch (tuple[0]) {
        case PCMCIA_CISTPL_MANFID:
-               if (tuple[1] != 5) {
+               if (tuple[1] != 4) {
                        DPRINTF(("%s: wrong length manufacturer id (%d)\n",
                            __func__, tuple[1]));
                        break;
@@ -306,12 +306,13 @@
                p = cis->cis1_info_buf + 2;
                while (i <
                    sizeof(cis->cis1_info) / sizeof(cis->cis1_info[0])) {
+                       if (p >= cis->cis1_info_buf + tuple[1] || *p == '\xff')
+                               break;
                        cis->cis1_info[i++] = p;
                        while (*p != '\0' && *p != '\xff')
                                p++;
-                       if (*p == '\xff')
-                               break;
-                       p++;
+                       if (*p == '\0')
+                               p++;
                }
                break;