From patchwork Sun Aug 2 07:23:10 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roel Kluin X-Patchwork-Id: 38704 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n727K5cv029084 for ; Sun, 2 Aug 2009 07:20:05 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752054AbZHBHUC (ORCPT ); Sun, 2 Aug 2009 03:20:02 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752042AbZHBHUB (ORCPT ); Sun, 2 Aug 2009 03:20:01 -0400 Received: from mail-ew0-f214.google.com ([209.85.219.214]:60075 "EHLO mail-ew0-f214.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752017AbZHBHUA (ORCPT ); Sun, 2 Aug 2009 03:20:00 -0400 Received: by ewy10 with SMTP id 10so2366943ewy.37 for ; Sun, 02 Aug 2009 00:20:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=ITmYp5NFNcYxK/kJdZ4Xe4bmOAVa1t6zvf/Ew/9KGK0=; b=MtBNf+iKkSICy3fzMKV9zisJLiLs9mNVi0hmNxC+iIySU3vMsoIyQjI/0XmcBtW31w 5LFQFTwMs86HrQOh7/9POETEQ6VTvqeg0UBCeFfW+lz01bTObMORjKoqAfZoHRRWkByL E4cyE/rCbqJZMFWjCYZ20gsVhfq2/nsqw77PU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=L13KvfsU+DcUykDRyHgznvOZknBpbZr9+vA+OaIDnp7MqkOZCFae+X8H92YnrHIqaA XSv8V/n9L5sN91UNhZLqxPcQJ5Itd8UlIMB6b7EquO4m1qQ6OcxKLmmxrFHVzMz2kCUL 1jCA4Kth5R4D9RRKzEWCRNnCEfLL70bn4Ki+Y= Received: by 10.210.57.15 with SMTP id f15mr3364137eba.54.1249197600516; Sun, 02 Aug 2009 00:20:00 -0700 (PDT) Received: from zoinx.mars (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 5sm7697689eyf.18.2009.08.02.00.19.59 (version=SSLv3 cipher=RC4-MD5); Sun, 02 Aug 2009 00:19:59 -0700 (PDT) Message-ID: <4A753EDE.9030506@gmail.com> Date: Sun, 02 Aug 2009 09:23:10 +0200 From: Roel Kluin User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2 MIME-Version: 1.0 To: linville@tuxdriver.com, linux-wireless@vger.kernel.org, Andrew Morton Subject: [PATCH] airo: Read buffer overflow Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Check whether index is within bounds before testing the element. Signed-off-by: Roel Kluin --- -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c index c70604f..e8ac4d9 100644 --- a/drivers/net/wireless/airo.c +++ b/drivers/net/wireless/airo.c @@ -6819,7 +6819,7 @@ static int airo_set_txpow(struct net_device *dev, return -EINVAL; } clear_bit (FLAG_RADIO_OFF, &local->flags); - for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++) + for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++) if (v == cap_rid.txPowerLevels[i]) { readConfigRid(local, 1); local->config.txPower = v;