Search Linux Wireless

Re: [PATCH 4/4] ath5k: add bounds check to pdadc table

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thursday 08 April 2010 12:55:59 Bob Copeland wrote:
> We check the bounds on pdadc once when correcting for
> negative curves but not when we later copy values from
> from the pdadc_tmp array, leading to a potential overrun.
> 
> Although we shouldn't hit this case in practice, let's
> be consistent.
> 
> Reported-by: Dan Carpenter <error27@xxxxxxxxx>
> Signed-off-by: Bob Copeland <me@xxxxxxxxxxxxxxx>
> ---
>  drivers/net/wireless/ath/ath5k/phy.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath5k/phy.c
> b/drivers/net/wireless/ath/ath5k/phy.c index 81bdebd..65ac50b 100644
> --- a/drivers/net/wireless/ath/ath5k/phy.c
> +++ b/drivers/net/wireless/ath/ath5k/phy.c
> @@ -2560,7 +2560,7 @@ ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw
> *ah, max_idx = (pdadc_n < table_size) ? pdadc_n : table_size;
> 
>  		/* Fill pdadc_out table */
> -		while (pdadc_0 < max_idx)
> +		while (pdadc_0 < max_idx && pdadc_i < 128)
>  			pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++];
> 
>  		/* Need to extrapolate above this pdgain? */

for whatever it's worth :-)

Acked-by: Bruno Randolf <br1@xxxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux