Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73f57f83 authored by Roel Kluin's avatar Roel Kluin Committed by John W. Linville
Browse files

ath9k: Fix read buffer overflow 



Prevent a read of powInfo[-1] in the first iteration.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5bf6fcc2

drivers/net/wireless/ath/ath9k/eeprom.c

+8 −8
Original line number Diff line number Diff line
@@ -143,10 +143,10 @@ void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah, 
						       IS_CHAN_2GHZ(chan))) {

				matchIndex = i;

				break;

			} else if ((freq < ath9k_hw_fbin2freq(powInfo[i].bChannel,

						      IS_CHAN_2GHZ(chan))) &&

				   (freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel,

						      IS_CHAN_2GHZ(chan)))) {

			} else if (freq < ath9k_hw_fbin2freq(powInfo[i].bChannel,

						IS_CHAN_2GHZ(chan)) && i > 0 &&

				   freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel,

						IS_CHAN_2GHZ(chan))) {

				lowIndex = i - 1;

				break;

			}
@@ -198,10 +198,10 @@ void ath9k_hw_get_target_powers(struct ath_hw *ah, 
				matchIndex = i;

				break;

			} else

				if ((freq < ath9k_hw_fbin2freq(powInfo[i].bChannel,

						       IS_CHAN_2GHZ(chan))) &&

				    (freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel,

						       IS_CHAN_2GHZ(chan)))) {

				if (freq < ath9k_hw_fbin2freq(powInfo[i].bChannel,

						IS_CHAN_2GHZ(chan)) && i > 0 &&

				    freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel,

						IS_CHAN_2GHZ(chan))) {

					lowIndex = i - 1;

					break;

				}