From: Malcolm Priestley <tvboxspy@gmail.com>
Date: Mon, 19 Jan 2015 18:24:14 +0000 (+0000)
Subject: staging: vt6655: Fix RFbSetPower() error: buffer overflow 'priv->abyCCKPwrTbl' 15... 
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b0c5881e78b31ff7e90fb8fef23d65c078fec18e;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

staging: vt6655: Fix RFbSetPower() error: buffer overflow 'priv->abyCCKPwrTbl' 15 <= 56

Check uCH is not more than CB_MAX_CHANNEL_24G(14) on rates RATE_1M to RATE_11M

Return false as the call is invalid as these rates do not exist
above channel 14.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
index 27841aa0ca87..a6eabde6b30c 100644
--- a/drivers/staging/vt6655/rf.c
+++ b/drivers/staging/vt6655/rf.c
@@ -788,6 +788,9 @@ bool RFbSetPower(
 	case RATE_2M:
 	case RATE_5M:
 	case RATE_11M:
+		if (uCH > CB_MAX_CHANNEL_24G)
+			return false;
+
 		byPwr = priv->abyCCKPwrTbl[uCH];
 		byPwrdBm = priv->abyCCKDefaultPwr[uCH];
 		break;