Skip to contentSkip to conversation

ath9k: Read outside array bounds

PATCH New Roel Kluin 2 participants 2 messages Jul 25, 2009 – Jul 27, 2009 Qualcomm Atheros ATH9K wireless driver

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 ath9k: Read outside array bounds

Incorrect limits leads to reads outside array bounds.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/net/wireless/ath/ath9k/eeprom.c +2 -2
index a2fda70..ce0e86c 100644
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
 		integer = swab32(eep->modalHeader.antCtrlCommon);
 		eep->modalHeader.antCtrlCommon = integer;
 
-		for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+		for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
 			integer = swab32(eep->modalHeader.antCtrlChain[i]);
 			eep->modalHeader.antCtrlChain[i] = integer;
 		}

@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
 			ctlMode, numCtlModes, isHt40CtlMode,
 			(pCtlMode[ctlMode] & EXT_ADDITIVE));
 
-		for (i = 0; (i < AR5416_NUM_CTLS) &&
+		for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
 				pEepData->ctlIndex[i]; i++) {
 			DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
 				"  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "