Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 522536f6 authored by Larry Finger's avatar Larry Finger Committed by John W. Linville
Browse files

[PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise 



An assert statement near the start of handle_irq_noise in the softmac
version of bcm43xx_main.c is there to protect against out of bound
addressing using variable bcm->noisecalc.nr_samples. The arrays in
question have a dimension of 8, thus the value must be < 8.

Signed-Off-By: default avatarLarry.Finger <Larry.Finger@lwfinger.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 120bda20

drivers/net/wireless/bcm43xx/bcm43xx_main.c

+1 −1
Original line number Diff line number Diff line
@@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm) 
		goto generate_new;



	/* Get the noise samples. */

	assert(bcm->noisecalc.nr_samples <= 8);

	assert(bcm->noisecalc.nr_samples < 8);

	i = bcm->noisecalc.nr_samples;

	noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);

	noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);