Re: [PATCH 4/4] ath5k: add bounds check to pdadc table

[Bruno Randolf <br1@einfach.org>]

On Thursday 08 April 2010 12:55:59 Bob Copeland wrote:
> We check the bounds on pdadc once when correcting for
> negative curves but not when we later copy values from
> from the pdadc_tmp array, leading to a potential overrun.
> 
> Although we shouldn't hit this case in practice, let's
> be consistent.
> 
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Bob Copeland <me@bobcopeland.com>
> ---
>  drivers/net/wireless/ath/ath5k/phy.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath5k/phy.c
> b/drivers/net/wireless/ath/ath5k/phy.c index 81bdebd..65ac50b 100644
> --- a/drivers/net/wireless/ath/ath5k/phy.c
> +++ b/drivers/net/wireless/ath/ath5k/phy.c
> @@ -2560,7 +2560,7 @@ ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw
> *ah, max_idx = (pdadc_n < table_size) ? pdadc_n : table_size;
> 
>  		/* Fill pdadc_out table */
> -		while (pdadc_0 < max_idx)
> +		while (pdadc_0 < max_idx && pdadc_i < 128)
>  			pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++];
> 
>  		/* Need to extrapolate above this pdgain? */

for whatever it's worth :-)

Acked-by: Bruno Randolf <br1@einfach.org>