ath5k: add bounds check to pdadc table
authorBob Copeland <me@bobcopeland.com>
Thu, 8 Apr 2010 03:55:59 +0000 (23:55 -0400)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 8 Apr 2010 19:24:16 +0000 (15:24 -0400)
We check the bounds on pdadc once when correcting for
negative curves but not when we later copy values from
from the pdadc_tmp array, leading to a potential overrun.

Although we shouldn't hit this case in practice, let's
be consistent.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Acked-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ath/ath5k/phy.c

index fcfc32d4da20a576cd65db424d6ee9b104c56b04..4a49dbb173529427805eb9c266c93706d2161374 100644 (file)
@@ -2557,7 +2557,7 @@ ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw *ah,
                max_idx = (pdadc_n < table_size) ? pdadc_n : table_size;
 
                /* Fill pdadc_out table */
-               while (pdadc_0 < max_idx)
+               while (pdadc_0 < max_idx && pdadc_i < 128)
                        pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++];
 
                /* Need to extrapolate above this pdgain? */