libertas: Read outside array bounds
authorRoel Kluin <roel.kluin@gmail.com>
Tue, 28 Jul 2009 07:59:47 +0000 (09:59 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 29 Jul 2009 18:52:01 +0000 (14:52 -0400)
reads bss->rates[j] before checking bounds of index, and should use
ARRAY_SIZE to determine the size of the array.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/libertas/scan.c

index 601b54249677412cd5f797be38311dbfcfdf20b4..6c95af3023ccf366897726c5fa460a3d5933d72f 100644 (file)
@@ -5,6 +5,7 @@
   *  for sending scan commands to the firmware.
   */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
        iwe.u.bitrate.disabled = 0;
        iwe.u.bitrate.value = 0;
 
-       for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+       for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                /* Bit rate given in 500 kb/s units */
                iwe.u.bitrate.value = bss->rates[j] * 500000;
                current_val = iwe_stream_add_value(info, start, current_val,