projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 0bf52b9)
ipw2x00: Write outside array bounds
authorZhu Yi <yi.zhu@intel.com>
Mon, 27 Jul 2009 02:10:20 +0000 (10:10 +0800)
committerJohn W. Linville <linville@tuxdriver.com>
Fri, 7 Aug 2009 17:09:28 +0000 (13:09 -0400)
> channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
> incremented. This might be able to access 1 past the end of the array

Reported-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ipw2x00/ipw2200.c patch | blob | blame | history

diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f67285ab608d3bf254db3498be3854962..6dcac73b4d299ee80e4bbf40877387620d3066ea 100644 (file)
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
                        };
 
                        u8 channel;
-                       while (channel_index < IPW_SCAN_CHANNELS) {
+                       while (channel_index < IPW_SCAN_CHANNELS - 1) {
                                channel =
                                    priv->speed_scan[priv->speed_scan_pos];
                                if (channel == 0) {