Staging: wlan-ng: off by one in prism2mgmt_scan_results()

Count is used to cap "req->bssindex.data" which is used as an offset
into the hw->scanresults->info.hscanresult.result[] array.  The array
has only HFA384x_SCANRESULT_MAX (31) elements so the 32 is off by one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c
index c3bb05dd744f..4efa9bc0fcf0 100644
--- a/drivers/staging/wlan-ng/prism2mgmt.c
+++ b/drivers/staging/wlan-ng/prism2mgmt.c
@@ -380,8 +380,8 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp)
         }
 
         count = (hw->scanresults->framelen - 3) / 32;
-        if (count > 32)
-                count = 32;
+        if (count > HFA384x_SCANRESULT_MAX)
+                count = HFA384x_SCANRESULT_MAX;
 
         if (req->bssindex.data >= count) {
                 pr_debug("requested index (%d) out of range (%d)\n",