From: James Harper <james.harper@bendigoit.com.au>
Date: Sat, 10 Feb 2007 00:28:41 +0000 (+0000)
Subject: Fix some bad pointer arithmatic in the tg3 driver that was causing the dynamic memory... 
X-Git-Tag: v0.9.3~455
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1735d5fc26b15177e49f0756fa76c9850a30b21;p=thirdparty%2Fipxe.git

Fix some bad pointer arithmatic in the tg3 driver that was causing the dynamic memory pool to be corrupted (or worse)
---

diff --git a/src/drivers/net/tg3.c b/src/drivers/net/tg3.c
index 1d94ba79f..973573de8 100644
--- a/src/drivers/net/tg3.c
+++ b/src/drivers/net/tg3.c
@@ -3167,16 +3167,16 @@ static void tg3_transmit(struct nic *nic, const char *dst_addr,
 	
 	/* Copy the packet to the our local buffer */
 	frame = &tg3_bss.tx_frame[frame_idx];
-	memcpy(frame[frame_idx].dst_addr, dst_addr, ETH_ALEN);
-	memcpy(frame[frame_idx].src_addr, nic->node_addr, ETH_ALEN);
-	frame[frame_idx].type = htons(type);
-	memset(frame[frame_idx].data, 0, sizeof(frame[frame_idx].data));
-	memcpy(frame[frame_idx].data, packet, size);
+	memcpy(frame->dst_addr, dst_addr, ETH_ALEN);
+	memcpy(frame->src_addr, nic->node_addr, ETH_ALEN);
+	frame->type = htons(type);
+	memset(frame->data, 0, sizeof(frame->data));
+	memcpy(frame->data, packet, size);
 
 	/* Setup the ring buffer entry to transmit */
 	txd            = &tp->tx_ring[entry];
 	txd->addr_hi   = 0; /* Etherboot runs under 4GB */
-	txd->addr_lo   = virt_to_bus(&frame[frame_idx]);
+	txd->addr_lo   = virt_to_bus(frame);
 	txd->len_flags = ((size + ETH_HLEN) << TXD_LEN_SHIFT) | TXD_FLAG_END;
 	txd->vlan_tag  = 0 << TXD_VLAN_TAG_SHIFT;