redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

Staging: wlan-ng: off by one in prism2mgmt_scan_results() 

Count is used to cap "req->bssindex.data" which is used as an offset
into the hw->scanresults->info.hscanresult.result[] array.  The array
has only HFA384x_SCANRESULT_MAX (31) elements so the 32 is off by one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hifive-unleashed-5.1
Dan Carpenter 2012-04-18 09:48:59 +03:00 committed by Greg Kroah-Hartman
parent 0d19cd36a5
commit bb46f130a0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/wlan-ng/prism2mgmt.c
View File

@ -380,8 +380,8 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp)
}
count = (hw->scanresults->framelen - 3) / 32;
if (count > 32)
count = 32;
if (count > HFA384x_SCANRESULT_MAX)
count = HFA384x_SCANRESULT_MAX;
if (req->bssindex.data >= count) {
pr_debug("requested index (%d) out of range (%d)\n",