Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 008749fc authored by Roel Kluin's avatar Roel Kluin Committed by John W. Linville
Browse files

ath9k: Read outside array bounds 



Incorrect limits leads to reads outside array bounds.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Acked-by: default avatarLuis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 3d0ccd02

drivers/net/wireless/ath/ath9k/eeprom.c

+2 −2
Original line number Diff line number Diff line
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah) 
		integer = swab32(eep->modalHeader.antCtrlCommon);

		eep->modalHeader.antCtrlCommon = integer;



		for (i = 0; i < AR5416_MAX_CHAINS; i++) {

		for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {

			integer = swab32(eep->modalHeader.antCtrlChain[i]);

			eep->modalHeader.antCtrlChain[i] = integer;

		}
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah, 
			ctlMode, numCtlModes, isHt40CtlMode,

			(pCtlMode[ctlMode] & EXT_ADDITIVE));



		for (i = 0; (i < AR5416_NUM_CTLS) &&

		for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&

				pEepData->ctlIndex[i]; i++) {

			DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,

				"  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "