Commit d54601b9 authored Sep 21, 2012 by Raja Mani Committed by Kalle Valo Oct 24, 2012

ath6kl: Check for valid rate table index



There are 28 items defined in rate table array 'wmi_rate_tbl'.
The rate table index (reply->rate_index) in ath6kl_wmi_bitrate_reply_rx()
func is not checked for the valid max limit index before accessing
rate table array. There may be some incidents to get memory crashes
without safe max check. Fix this.

Found this on code review.

Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

parent 43a06b34

drivers/net/wireless/ath/ath6kl/wmi.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1174,6 +1174,9 @@ static int ath6kl_wmi_bitrate_reply_rx(struct wmi wmi, u8 datap, int len)
		rate = RATE_AUTO;
		} else {
		index = reply->rate_index & 0x7f;
		if (WARN_ON_ONCE(index > (RATE_MCS_7_40 + 1)))
		return -EINVAL;

		sgi = (reply->rate_index & 0x80) ? 1 : 0;
		rate = wmi_rate_tbl[index][sgi];
		}