On Thursday 08 April 2010 12:55:59 Bob Copeland wrote: > We check the bounds on pdadc once when correcting for > negative curves but not when we later copy values from > from the pdadc_tmp array, leading to a potential overrun. > > Although we shouldn't hit this case in practice, let's > be consistent. > > Reported-by: Dan Carpenter <erro...@gmail.com> > Signed-off-by: Bob Copeland <m...@bobcopeland.com> > --- > drivers/net/wireless/ath/ath5k/phy.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath5k/phy.c > b/drivers/net/wireless/ath/ath5k/phy.c index 81bdebd..65ac50b 100644 > --- a/drivers/net/wireless/ath/ath5k/phy.c > +++ b/drivers/net/wireless/ath/ath5k/phy.c > @@ -2560,7 +2560,7 @@ ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw > *ah, max_idx = (pdadc_n < table_size) ? pdadc_n : table_size; > > /* Fill pdadc_out table */ > - while (pdadc_0 < max_idx) > + while (pdadc_0 < max_idx && pdadc_i < 128) > pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++]; > > /* Need to extrapolate above this pdgain? */
for whatever it's worth :-) Acked-by: Bruno Randolf <b...@einfach.org> _______________________________________________ ath5k-devel mailing list ath5k-devel@lists.ath5k.org https://lists.ath5k.org/mailman/listinfo/ath5k-devel
