Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-01 01:31:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipw2x00: Write outside array bounds

Browse Source 
> channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
> incremented. This might be able to access 1 past the end of the array

Reported-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Zhu Yi 2009-07-27 10:10:20 +08:00 committed by John W. Linville
parent 0bf52b9817
commit 7dd2459d8f
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/wireless/ipw2x00/ipw2200.c
View File

@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
};
u8 channel;
while (channel_index < IPW_SCAN_CHANNELS) {
while (channel_index < IPW_SCAN_CHANNELS - 1) {
channel =
priv->speed_scan[priv->speed_scan_pos];
if (channel == 0) {