Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f59fce9 authored by Bob Copeland's avatar Bob Copeland Committed by John W. Linville
Browse files

ath5k: add bounds check to pdadc table 



We check the bounds on pdadc once when correcting for
negative curves but not when we later copy values from
from the pdadc_tmp array, leading to a potential overrun.

Although we shouldn't hit this case in practice, let's
be consistent.

Reported-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarBob Copeland <me@bobcopeland.com>
Acked-by: default avatarBruno Randolf <br1@einfach.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent a05988bb

drivers/net/wireless/ath/ath5k/phy.c

+1 −1
Original line number Diff line number Diff line
@@ -2557,7 +2557,7 @@ ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw *ah, 
		max_idx = (pdadc_n < table_size) ? pdadc_n : table_size;



		/* Fill pdadc_out table */

		while (pdadc_0 < max_idx)

		while (pdadc_0 < max_idx && pdadc_i < 128)

			pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++];



		/* Need to extrapolate above this pdgain? */