summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
diff options
context:
space:
mode:
authorZhu Yi <yi.zhu@intel.com>2009-07-27 10:10:20 +0800
committerJohn W. Linville <linville@tuxdriver.com>2009-08-07 13:09:28 -0400
commit7dd2459d8f7a967bcd1466591aec72bb3ddc07cc (patch)
treec07513130a369e62e0ea9fbc6522ade3321700ca /drivers/net/wireless
parent0bf52b981770cbf006323bab5177f2858a196766 (diff)
downloadop-kernel-dev-7dd2459d8f7a967bcd1466591aec72bb3ddc07cc.zip
op-kernel-dev-7dd2459d8f7a967bcd1466591aec72bb3ddc07cc.tar.gz
ipw2x00: Write outside array bounds
> channel_index loops up to IPW_SCAN_CHANNELS, but is used after being > incremented. This might be able to access 1 past the end of the array Reported-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless')
-rw-r--r--drivers/net/wireless/ipw2x00/ipw2200.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3..6dcac73 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
};
u8 channel;
- while (channel_index < IPW_SCAN_CHANNELS) {
+ while (channel_index < IPW_SCAN_CHANNELS - 1) {
channel =
priv->speed_scan[priv->speed_scan_pos];
if (channel == 0) {
OpenPOWER on IntegriCloud