From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from hera.kernel.org ([140.211.167.34]:54581 "EHLO hera.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755823Ab0HKUeX (ORCPT ); Wed, 11 Aug 2010 16:34:23 -0400 Date: Wed, 11 Aug 2010 20:32:16 +0000 From: Denis Kirjanov To: linville@tuxdriver.com Cc: proski@gnu.org, hermes@gibson.dropbear.id.au, davem@davemloft.net, linux-wireless@vger.kernel.org, orinoco-devel@lists.sourceforge.net, netdev@vger.kernel.org Subject: [PATCH] orinoco: Fix walking past the end of the buffer Message-ID: <20100811203216.GA25168@hera.kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-wireless-owner@vger.kernel.org List-ID: Fix walking past the end of the bitrate_table array in the case when the loop counter == BITRATE_TABLE_SIZE. Mark bitrate as invalid in this case for the orinoco_ioctl_setrate() Signed-off-by: Denis Kirjanov --- diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c index 077baa8..191bc03 100644 --- a/drivers/net/wireless/orinoco/hw.c +++ b/drivers/net/wireless/orinoco/hw.c @@ -765,9 +765,12 @@ int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate) if (bitrate_table[i].intersil_txratectrl == val) break; - if (i >= BITRATE_TABLE_SIZE) + if (i >= BITRATE_TABLE_SIZE) { printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n", priv->ndev->name, val); + *bitrate = 100001; /* Mark as invalid */ + break; + } *bitrate = bitrate_table[i].bitrate * 100000; break; From mboxrd@z Thu Jan 1 00:00:00 1970 From: Denis Kirjanov Subject: [PATCH] orinoco: Fix walking past the end of the buffer Date: Wed, 11 Aug 2010 20:32:16 +0000 Message-ID: <20100811203216.GA25168@hera.kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: proski-mXXj517/zsQ@public.gmane.org, hermes-xT8FGy+AXnRB3Ne2BGzF6laj5H9X9Tb+@public.gmane.org, davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org, linux-wireless-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, orinoco-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: linville-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org Return-path: Content-Disposition: inline Sender: linux-wireless-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org Fix walking past the end of the bitrate_table array in the case when the loop counter == BITRATE_TABLE_SIZE. Mark bitrate as invalid in this case for the orinoco_ioctl_setrate() Signed-off-by: Denis Kirjanov --- diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c index 077baa8..191bc03 100644 --- a/drivers/net/wireless/orinoco/hw.c +++ b/drivers/net/wireless/orinoco/hw.c @@ -765,9 +765,12 @@ int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate) if (bitrate_table[i].intersil_txratectrl == val) break; - if (i >= BITRATE_TABLE_SIZE) + if (i >= BITRATE_TABLE_SIZE) { printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n", priv->ndev->name, val); + *bitrate = 100001; /* Mark as invalid */ + break; + } *bitrate = bitrate_table[i].bitrate * 100000; break; -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html