Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 88e05d85 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: rtl8192su: buffer overflow in r8192U_core.c



There was a buffer overflow in the original code.  rf_path was 2 and it should
have been only 0 or 1.

I don't have the hardware for this, so I can't test it.

Looking at the code, there are two almost identical sections for updating the
hal variables.  The first one was clearly wrong and had the array overflow as 
well.  The second one looked correct.  I decided to use the second section as
is except for whitespace changes.

The differences between the two original sections:
1)  The second one had more debug output.
2)  The second one looped over rf_path instead of corrupting data.
3)  The second one had these additional assigments.
                      if (rf_path == 0) {
                              priv->TxPowerLevelOFDM24G[i] = priv->RfTxPwrLevelOfdm1T[rf_path][i] ;
                              priv->TxPowerLevelCCK[i] = priv->RfTxPwrLevelCck[rf_path][i];
                      }

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Cc: Jerry chuang <wlanfae@realtek.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 00367a6d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment