From: Bob Copeland <me@bobcopeland.com>
Date: Thu, 8 Apr 2010 03:55:59 +0000 (-0400)
Subject: ath5k: add bounds check to pdadc table
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4f59fce9e099fb6ba3c8361e5094163a3efce5be;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git

ath5k: add bounds check to pdadc table

We check the bounds on pdadc once when correcting for
negative curves but not when we later copy values from
from the pdadc_tmp array, leading to a potential overrun.

Although we shouldn't hit this case in practice, let's
be consistent.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Acked-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index fcfc32d4da20..4a49dbb17352 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -2557,7 +2557,7 @@ ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw *ah,
 		max_idx = (pdadc_n < table_size) ? pdadc_n : table_size;
 
 		/* Fill pdadc_out table */
-		while (pdadc_0 < max_idx)
+		while (pdadc_0 < max_idx && pdadc_i < 128)
 			pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++];
 
 		/* Need to extrapolate above this pdgain? */