aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-07-28 12:05:00 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-07-29 14:52:01 -0400
commit57921c312e8cef72ba35a4cfe870b376da0b1b87 (patch)
treea8de0efe7d381f6990b73f338090574f5584f981 /net
parent430453fc2a5f3f2c1d98ebc3c3d4c54f3060e3c3 (diff)
libertas: Read buffer overflow
Several arrays were read before checking whether the index was within bounds. ARRAY_SIZE() should be used to determine the size of arrays. rates->rates has an arraysize of 1, so calling get_common_rates() with a rates_size of MAX_RATES (14) was causing reads out of bounds. tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1), so that should be the number of elements of tmp[]. A goto can be eliminated: ret was already set upon its declaration. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions