diff options
author | Roel Kluin <roel.kluin@gmail.com> | 2009-08-07 23:50:00 +0200 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-08-28 14:40:46 -0400 |
commit | 73f57f8398ed6cba82f9856e20d94d71e6edb3e2 (patch) | |
tree | 132627d29a3a264b7ea774f5f17bdad87e01a962 /drivers/net | |
parent | 5bf6fcc2bbfb90d997f88c969f1ceee35d064a24 (diff) | |
download | kernel_samsung_tuna-73f57f8398ed6cba82f9856e20d94d71e6edb3e2.zip kernel_samsung_tuna-73f57f8398ed6cba82f9856e20d94d71e6edb3e2.tar.gz kernel_samsung_tuna-73f57f8398ed6cba82f9856e20d94d71e6edb3e2.tar.bz2 |
ath9k: Fix read buffer overflow
Prevent a read of powInfo[-1] in the first iteration.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
-rw-r--r-- | drivers/net/wireless/ath/ath9k/eeprom.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c index 958948b..b6e52d0 100644 --- a/drivers/net/wireless/ath/ath9k/eeprom.c +++ b/drivers/net/wireless/ath/ath9k/eeprom.c @@ -143,10 +143,10 @@ void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah, IS_CHAN_2GHZ(chan))) { matchIndex = i; break; - } else if ((freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, - IS_CHAN_2GHZ(chan))) && - (freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, - IS_CHAN_2GHZ(chan)))) { + } else if (freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, + IS_CHAN_2GHZ(chan)) && i > 0 && + freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, + IS_CHAN_2GHZ(chan))) { lowIndex = i - 1; break; } @@ -198,10 +198,10 @@ void ath9k_hw_get_target_powers(struct ath_hw *ah, matchIndex = i; break; } else - if ((freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, - IS_CHAN_2GHZ(chan))) && - (freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, - IS_CHAN_2GHZ(chan)))) { + if (freq < ath9k_hw_fbin2freq(powInfo[i].bChannel, + IS_CHAN_2GHZ(chan)) && i > 0 && + freq > ath9k_hw_fbin2freq(powInfo[i - 1].bChannel, + IS_CHAN_2GHZ(chan))) { lowIndex = i - 1; break; } |