diff options
| author |   Roel Kluin <roel.kluin@gmail.com> | 2009-08-07 23:50:00 +0200 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2009-08-28 14:40:46 -0400 |
| commit | 73f57f8398ed6cba82f9856e20d94d71e6edb3e2 (patch) | |
| tree | 132627d29a3a264b7ea774f5f17bdad87e01a962 /drivers/net/wireless/ath/ath9k/eeprom.c | |
| parent | mac80211: Check pending scan request after having processed mgd work (diff) | |
| download | linux-dev-73f57f8398ed6cba82f9856e20d94d71e6edb3e2.tar.xz linux-dev-73f57f8398ed6cba82f9856e20d94d71e6edb3e2.zip | |
ath9k: Fix read buffer overflow
Prevent a read of powInfo[-1] in the first iteration.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/eeprom.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/eeprom.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c index 958948bc73fd..b6e52d0f8c48 100644 --- a/drivers/net/wireless/ath/ath9k/eeprom.c +++ b/drivers/net/wireless/ath/ath9k/eeprom.c @@ -143,10 +143,10 @@ void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah, IS_CHAN_2GHZ(chan))) { matchIndex = i; break; - } else if ((freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, - IS_CHAN_2GHZ(chan))) && - (freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, - IS_CHAN_2GHZ(chan)))) { + } else if (freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, + IS_CHAN_2GHZ(chan)) && i > 0 && + freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, + IS_CHAN_2GHZ(chan))) { lowIndex = i - 1; break; } @@ -198,10 +198,10 @@ void ath9k_hw_get_target_powers(struct ath_hw *ah, matchIndex = i; break; } else - if ((freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, - IS_CHAN_2GHZ(chan))) && - (freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, - IS_CHAN_2GHZ(chan)))) { + if (freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, + IS_CHAN_2GHZ(chan)) && i > 0 && + freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, + IS_CHAN_2GHZ(chan))) { lowIndex = i - 1; break; } |