Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 430453fc authored by Roel Kluin's avatar Roel Kluin Committed by John W. Linville
Browse files

libertas: Read outside array bounds 



reads bss->rates[j] before checking bounds of index, and should use
ARRAY_SIZE to determine the size of the array.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Acked-by: default avatarHolger Schurig <hs4233@mail.mn-solutions.de>
Acked-by: default avatarDan Williams <dcbw@redhat.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 78f1a8b7

drivers/net/wireless/libertas/scan.c

+2 −1
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ 
  *  for sending scan commands to the firmware.

  */

#include <linux/types.h>

#include <linux/kernel.h>

#include <linux/etherdevice.h>

#include <linux/if_arp.h>

#include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv, 
	iwe.u.bitrate.disabled = 0;

	iwe.u.bitrate.value = 0;



	for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {

	for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {

		/* Bit rate given in 500 kb/s units */

		iwe.u.bitrate.value = bss->rates[j] * 500000;

		current_val = iwe_stream_add_value(info, start, current_val,