diff options
| author | Larry Finger <Larry.Finger@lwfinger.net> | 2006-06-28 19:11:21 -0500 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2006-07-10 14:16:26 -0400 |
| commit | 522536f6b24e63ac946259af65224f107dff7857 (patch) | |
| tree | 3bafc9a0dd35f4dfea0e74ca3b9fb3d65a006536 /drivers/net/wireless/bcm43xx | |
| parent | 120bda20c6f64b32e8bfbdd7b34feafaa5f5332e (diff) | |
[PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise
An assert statement near the start of handle_irq_noise in the softmac
version of bcm43xx_main.c is there to protect against out of bound
addressing using variable bcm->noisecalc.nr_samples. The arrays in
question have a dimension of 8, thus the value must be < 8.
Signed-Off-By: Larry.Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/bcm43xx')
| -rw-r--r-- | drivers/net/wireless/bcm43xx/bcm43xx_main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c index e1c5a939bca..3889f79e712 100644 --- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c +++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c @@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm) goto generate_new; /* Get the noise samples. */ - assert(bcm->noisecalc.nr_samples <= 8); + assert(bcm->noisecalc.nr_samples < 8); i = bcm->noisecalc.nr_samples; noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); |