diff options
author | Roel Kluin <roel.kluin@gmail.com> | 2009-07-28 12:05:00 +0200 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-07-29 14:52:01 -0400 |
commit | 57921c312e8cef72ba35a4cfe870b376da0b1b87 (patch) | |
tree | a8de0efe7d381f6990b73f338090574f5584f981 /net/mac80211/pm.c | |
parent | 430453fc2a5f3f2c1d98ebc3c3d4c54f3060e3c3 (diff) |
libertas: Read buffer overflow
Several arrays were read before checking whether the index was within
bounds. ARRAY_SIZE() should be used to determine the size of arrays.
rates->rates has an arraysize of 1, so calling get_common_rates()
with a rates_size of MAX_RATES (14) was causing reads out of bounds.
tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) *
(*rates_size - 1), so that should be the number of elements of tmp[].
A goto can be eliminated: ret was already set upon its declaration.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/pm.c')
0 files changed, 0 insertions, 0 deletions