From patchwork Mon Jul 27 02:10:20 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhu Yi X-Patchwork-Id: 37441 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n6R2AQ1H029562 for ; Mon, 27 Jul 2009 02:10:26 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755565AbZG0CKW (ORCPT ); Sun, 26 Jul 2009 22:10:22 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754152AbZG0CKW (ORCPT ); Sun, 26 Jul 2009 22:10:22 -0400 Received: from mga03.intel.com ([143.182.124.21]:26021 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755565AbZG0CKV (ORCPT ); Sun, 26 Jul 2009 22:10:21 -0400 Received: from azsmga001.ch.intel.com ([10.2.17.19]) by azsmga101.ch.intel.com with ESMTP; 26 Jul 2009 19:10:22 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.43,273,1246863600"; d="scan'208";a="169134098" Received: from debian.sh.intel.com (HELO [10.239.13.167]) ([10.239.13.167]) by azsmga001.ch.intel.com with ESMTP; 26 Jul 2009 19:10:21 -0700 Subject: Re: [PATCH] ipw2x00: Write outside array bounds From: Zhu Yi To: Roel Kluin Cc: "linux-wireless@vger.kernel.org" , "ipw2100-devel@lists.sourceforge.net" , Andrew Morton In-Reply-To: <4A6B7DB0.7090902@gmail.com> References: <4A6B7DB0.7090902@gmail.com> Date: Mon, 27 Jul 2009 10:10:20 +0800 Message-Id: <1248660620.3747.102.camel@debian> Mime-Version: 1.0 X-Mailer: Evolution 2.26.1 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org On Sun, 2009-07-26 at 05:48 +0800, Roel Kluin wrote: > channel_index loops up to IPW_SCAN_CHANNELS, but is used after being > incremented. This might be able to access 1 past the end of the array > > Signed-off-by: Roel Kluin Thanks. Do you think below patch is better? Thanks, -yi > --- > diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c > index 44c29b3..d1c9d6d 100644 > --- a/drivers/net/wireless/ipw2x00/ipw2200.c > +++ b/drivers/net/wireless/ipw2x00/ipw2200.c > @@ -6249,7 +6249,10 @@ static void ipw_add_scan_channels(struct ipw_priv *priv, > > channels[channel - 1] = 1; > priv->speed_scan_pos++; > - channel_index++; > + > + if (++channel_index >= IPW_SCAN_CHANNELS) > + break; > + > scan->channels_list[channel_index] = channel; > index = > ieee80211_channel_to_index(priv->ieee, channel); --- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c index 2dc1cdb..07f171c 100644 --- a/drivers/net/wireless/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/ipw2x00/ipw2200.c @@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv, }; u8 channel; - while (channel_index < IPW_SCAN_CHANNELS) { + while (channel_index < IPW_SCAN_CHANNELS - 1) { channel = priv->speed_scan[priv->speed_scan_pos]; if (channel == 0) {