Hi! On 11 February 2012 07:01, Pavel Roskin <proski@xxxxxxx> wrote: > Rate control algorithms are supposed to stop processing when they > encounter a rate with the index -1. Checking for rate->count not being > zero is not enough. > > Allowing a rate with negative index leads to memory corruption in > ath_debug_stat_rc(). > > One consequence of the bug is discussed at > https://bugzilla.redhat.com/show_bug.cgi?id=768639 > > Signed-off-by: Pavel Roskin <proski@xxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx Great catch! Adrian -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
