Skip to contentSkip to conversation

ipw2x00: Write outside array bounds

PATCH In review Roel Kluin 3 participants 4 messages Jul 25, 2009 – Aug 4, 2009 Networking drivers (wireless)

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 ipw2x00: Write outside array bounds

channel_index loops up to IPW_SCAN_CHANNELS, but is used after being incremented. This might be able to access 1 past the end of the array

Signed-off-by Roel Kluin <[email protected]>

---

drivers/net/wireless/ipw2x00/ipw2200.c +4 -1
index 44c29b3..d1c9d6d 100644
@@ -6249,7 +6249,10 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
 
 				channels[channel - 1] = 1;
 				priv->speed_scan_pos++;
-				channel_index++;
+
+				if (++channel_index >= IPW_SCAN_CHANNELS)
+					break;
+
 				scan->channels_list[channel_index] = channel;
 				index =
 				    ieee80211_channel_to_index(priv->ieee, channel);
#1 lore raw
Quoted 4 lines · Roel Kluin

channel_index loops up to IPW_SCAN_CHANNELS, but is used after being incremented. This might be able to access 1 past the end of the array

Signed-off-by Roel Kluin <[email protected]>

Thanks. Do you think below patch is better?

Thanks,
-yi

drivers/net/wireless/ipw2x00/ipw2200.c +1 -1
index 2dc1cdb..07f171c 100644
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
 			};
 
 			u8 channel;
-			while (channel_index < IPW_SCAN_CHANNELS) {
+			while (channel_index < IPW_SCAN_CHANNELS - 1) {
 				channel =
 				    priv->speed_scan[priv->speed_scan_pos];
 				if (channel == 0) {
Quoted 17 lines

---

drivers/net/wireless/ipw2x00/ipw2200.c +4 -1
index 44c29b3..d1c9d6d 100644
@@ -6249,7 +6249,10 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
 
 				channels[channel - 1] = 1;
 				priv->speed_scan_pos++;
-				channel_index++;
+
+				if (++channel_index >= IPW_SCAN_CHANNELS)
+					break;
+
 				scan->channels_list[channel_index] = channel;
 				index =
 				    ieee80211_channel_to_index(priv->ieee, channel);
#2 lore raw
Quoted 7 lines · Zhu Yi
Quoted 4 lines · Roel Kluin

channel_index loops up to IPW_SCAN_CHANNELS, but is used after being incremented. This might be able to access 1 past the end of the array

Signed-off-by Roel Kluin <[email protected]>

Thanks. Do you think below patch is better?

Didn't see an answer here...which patch do we want?

John

Signature · 3 lines
John W. Linville		Someday the world will need a hero, and you
[email protected]			might be all we have.  Be ready.
			¡Viva Honduras Libre!
#3 lore raw
Quoted 10 lines · John W. Linville
Quoted 7 lines · Zhu Yi
Quoted 4 lines · Roel Kluin

channel_index loops up to IPW_SCAN_CHANNELS, but is used after being incremented. This might be able to access 1 past the end of the array

Signed-off-by Roel Kluin <[email protected]>

Thanks. Do you think below patch is better?

Didn't see an answer here...which patch do we want?

Please apply mine.

Thanks,
-yi