channel_index loops up to IPW_SCAN_CHANNELS, but is used after being incremented. This might be able to access 1 past the end of the array Signed-off-by: Roel Kluin <roel.kluin@xxxxxxxxx> --- diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c index 44c29b3..d1c9d6d 100644 --- a/drivers/net/wireless/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/ipw2x00/ipw2200.c @@ -6249,7 +6249,10 @@ static void ipw_add_scan_channels(struct ipw_priv *priv, channels[channel - 1] = 1; priv->speed_scan_pos++; - channel_index++; + + if (++channel_index >= IPW_SCAN_CHANNELS) + break; + scan->channels_list[channel_index] = channel; index = ieee80211_channel_to_index(priv->ieee, channel); -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
