diff options
| author | Zhu Yi <yi.zhu@intel.com> | 2009-07-26 22:10:20 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-07 13:09:28 -0400 |
| commit | 7dd2459d8f7a967bcd1466591aec72bb3ddc07cc (patch) | |
| tree | c07513130a369e62e0ea9fbc6522ade3321700ca /drivers | |
| parent | 0bf52b981770cbf006323bab5177f2858a196766 (diff) | |
ipw2x00: Write outside array bounds
> channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
> incremented. This might be able to access 1 past the end of the array
Reported-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/ipw2x00/ipw2200.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c index 44c29b3f6728..6dcac73b4d29 100644 --- a/drivers/net/wireless/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/ipw2x00/ipw2200.c | |||
| @@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv, | |||
| 6226 | }; | 6226 | }; |
| 6227 | 6227 | ||
| 6228 | u8 channel; | 6228 | u8 channel; |
| 6229 | while (channel_index < IPW_SCAN_CHANNELS) { | 6229 | while (channel_index < IPW_SCAN_CHANNELS - 1) { |
| 6230 | channel = | 6230 | channel = |
| 6231 | priv->speed_scan[priv->speed_scan_pos]; | 6231 | priv->speed_scan[priv->speed_scan_pos]; |
| 6232 | if (channel == 0) { | 6232 | if (channel == 0) { |