* [PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise
@ 2006-06-29 0:11 Larry Finger
0 siblings, 0 replies; only message in thread
From: Larry Finger @ 2006-06-29 0:11 UTC (permalink / raw)
To: John Linville, netdev
An assert statement near the start of handle_irq_noise in the softmac version of bcm43xx_main.c is
there to protect against out of bound addressing using variable bcm->noisecalc.nr_samples. The
arrays in question have a dimension of 8, thus the value must be < 8.
Signed-Off-By: Larry.Finger <Larry.Finger@lwfinger.net>
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index af97755..c154be0 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm4
goto generate_new;
/* Get the noise samples. */
- assert(bcm->noisecalc.nr_samples <= 8);
+ assert(bcm->noisecalc.nr_samples < 8);
i = bcm->noisecalc.nr_samples;
noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
Larry
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2006-06-29 0:11 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-06-29 0:11 [PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise Larry Finger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).