Skip to contentSkip to conversation

libertas: Read outside array bounds

PATCH In review Roel Kluin 3 participants 3 messages Jul 28, 2009 Networking drivers (wireless)

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 libertas: Read outside array bounds

reads bss->rates[j] before checking bounds of index, and should use ARRAY_SIZE to determine the size of the array.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/net/wireless/libertas/scan.c +2 -1
index 601b542..6c95af3 100644
@@ -5,6 +5,7 @@
   *  for sending scan commands to the firmware.
   */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>

@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
 	iwe.u.bitrate.disabled = 0;
 	iwe.u.bitrate.value = 0;
 
-	for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+	for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
 		/* Bit rate given in 500 kb/s units */
 		iwe.u.bitrate.value = bss->rates[j] * 500000;
 		current_val = iwe_stream_add_value(info, start, current_val,
Acked-by on v1 1/1
#2 lore raw
In reply to Roel Kluin
Quoted 4 lines · Roel Kluin

reads bss->rates[j] before checking bounds of index, and should use ARRAY_SIZE to determine the size of the array.

Signed-off-by Roel Kluin <[email protected]>
Acked-by Dan Williams <[email protected]>
Quoted 22 lines

---

drivers/net/wireless/libertas/scan.c +2 -1
index 601b542..6c95af3 100644
@@ -5,6 +5,7 @@
   *  for sending scan commands to the firmware.
   */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>

@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
 	iwe.u.bitrate.disabled = 0;
 	iwe.u.bitrate.value = 0;
 
-	for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+	for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
 		/* Bit rate given in 500 kb/s units */
 		iwe.u.bitrate.value = bss->rates[j] * 500000;
 		current_val = iwe_stream_add_value(info, start, current_val,