From: Roel Kluin <roel.kluin@gmail.com>
To: Greg Kroah-Hartman <gregkh@suse.de>,
devel@driverdev.osuosl.org,
Andrew Morton <akpm@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: [PATCH] rtxxxx/sta_ioctl: rate_index one too large
Date: Tue, 10 Nov 2009 22:25:22 +0100 [thread overview]
Message-ID: <4AF9DA42.8060200@gmail.com> (raw)
`rate_count' is the size of ralinkrate[]. So an index
that equals rate_count is one too large.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
drivers/staging/rt2860/sta_ioctl.c | 4 ++--
drivers/staging/rt3090/sta_ioctl.c | 10 +++++-----
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rt2860/sta_ioctl.c b/drivers/staging/rt2860/sta_ioctl.c
index c0e0425..5344616 100644
--- a/drivers/staging/rt2860/sta_ioctl.c
+++ b/drivers/staging/rt2860/sta_ioctl.c
@@ -2572,8 +2572,8 @@ int rt_ioctl_giwrate(struct net_device *dev,
if (rate_index < 0)
rate_index = 0;
- if (rate_index > rate_count)
- rate_index = rate_count;
+ if (rate_index >= rate_count)
+ rate_index = rate_count - 1;
wrqu->bitrate.value = ralinkrate[rate_index] * 500000;
wrqu->bitrate.disabled = 0;
diff --git a/drivers/staging/rt3090/sta_ioctl.c b/drivers/staging/rt3090/sta_ioctl.c
index b8ab84a..a314cbb 100644
--- a/drivers/staging/rt3090/sta_ioctl.c
+++ b/drivers/staging/rt3090/sta_ioctl.c
@@ -1409,8 +1409,8 @@ int rt_ioctl_giwscan(struct net_device *dev,
int rate_index = 12 + ((UCHAR)capInfo.ChannelWidth * 24) + ((UCHAR)shortGI *48) + ((UCHAR)maxMCS);
if (rate_index < 0)
rate_index = 0;
- if (rate_index > rate_count)
- rate_index = rate_count;
+ if (rate_index >= rate_count)
+ rate_index = rate_count - 1;
iwe.u.bitrate.value = ralinkrate[rate_index] * 500000;
}
@@ -3163,8 +3163,8 @@ int rt_ioctl_giwrate(struct net_device *dev,
if (rate_index < 0)
rate_index = 0;
- if (rate_index > rate_count)
- rate_index = rate_count;
+ if (rate_index >= rate_count)
+ rate_index = rate_count - 1;
wrqu->bitrate.value = ralinkrate[rate_index] * 500000;
wrqu->bitrate.disabled = 0;
@@ -7554,4 +7554,4 @@ INT Set_Antenna_Proc(
return TRUE;
}
-#endif // ANT_DIVERSITY_SUPPORT //
\ No newline at end of file
+#endif // ANT_DIVERSITY_SUPPORT //
reply other threads:[~2009-11-10 21:13 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4AF9DA42.8060200@gmail.com \
--to=roel.kluin@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@suse.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox