diff options
| author |   Roel Kluin <roel.kluin@gmail.com> | 2009-07-28 09:59:47 +0200 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2009-07-29 14:52:01 -0400 |
| commit | 430453fc2a5f3f2c1d98ebc3c3d4c54f3060e3c3 (patch) | |
| tree | 74e17b7c611c42aef982ba96187d893e5de938a3 /drivers | |
| parent | mac80211: do not queue work after suspend in the dynamic ps timer (diff) | |
| download | linux-dev-430453fc2a5f3f2c1d98ebc3c3d4c54f3060e3c3.tar.xz linux-dev-430453fc2a5f3f2c1d98ebc3c3d4c54f3060e3c3.zip | |
libertas: Read outside array bounds
reads bss->rates[j] before checking bounds of index, and should use
ARRAY_SIZE to determine the size of the array.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/libertas/scan.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c index 601b54249677..6c95af3023cc 100644 --- a/drivers/net/wireless/libertas/scan.c +++ b/drivers/net/wireless/libertas/scan.c @@ -5,6 +5,7 @@ * for sending scan commands to the firmware. */ #include <linux/types.h> +#include <linux/kernel.h> #include <linux/etherdevice.h> #include <linux/if_arp.h> #include <asm/unaligned.h> @@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv, iwe.u.bitrate.disabled = 0; iwe.u.bitrate.value = 0; - for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) { + for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) { /* Bit rate given in 500 kb/s units */ iwe.u.bitrate.value = bss->rates[j] * 500000; current_val = iwe_stream_add_value(info, start, current_val, |