projects
/
GitHub
/
MotorolaMobilityLLC
/
kernel-slsi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
0bf52b9
)
ipw2x00: Write outside array bounds
author
Zhu Yi
<yi.zhu@intel.com>
Mon, 27 Jul 2009 02:10:20 +0000
(10:10 +0800)
committer
John W. Linville
<linville@tuxdriver.com>
Fri, 7 Aug 2009 17:09:28 +0000
(13:09 -0400)
> channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
> incremented. This might be able to access 1 past the end of the array
Reported-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ipw2x00/ipw2200.c
patch
|
blob
|
blame
|
history
diff --git
a/drivers/net/wireless/ipw2x00/ipw2200.c
b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f67285ab608d3bf254db3498be3854962..6dcac73b4d299ee80e4bbf40877387620d3066ea 100644
(file)
--- a/
drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/
drivers/net/wireless/ipw2x00/ipw2200.c
@@
-6226,7
+6226,7
@@
static void ipw_add_scan_channels(struct ipw_priv *priv,
};
u8 channel;
- while (channel_index < IPW_SCAN_CHANNELS) {
+ while (channel_index < IPW_SCAN_CHANNELS
- 1
) {
channel =
priv->speed_scan[priv->speed_scan_pos];
if (channel == 0) {