]> git.karo-electronics.de Git - linux-beck.git/commit
iwlwifi: mvm: rs: fix a theoretical out of bounds access
authorEyal Shapira <eyal@wizery.com>
Sun, 5 Jan 2014 19:04:19 +0000 (21:04 +0200)
committerEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Mon, 13 Jan 2014 20:17:16 +0000 (22:17 +0200)
commit560843f4ab7ba8c2e5edf01949bba4d7a94f01e9
tree5a880b673bf3dd85b3e5a5123eda8b3bc103292c
parent099d8f20b65d0dac07fb6e2ca0ed19e5d36d7d2e
iwlwifi: mvm: rs: fix a theoretical out of bounds access

Discovered by klocwork

Array 'iwl_rate_mcs' of size 15 may use index value(s) -1
  * rs.c:2562: index = iwl_hwrate_to_plcp_idx(rate)
    * rs.c:2562: Result of function call 'iwl_hwrate_to_plcp_idx(rate)' is '[-1,14]'
  * rs.c:2565: Array 'iwl_rate_mcs' size is 15.
  * rs.c:2565: Possible attempt to access element -1 of array 'iwl_rate_mcs'.

While at it stop using index = -1 and always use IWL_RATE_INVALID

Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
drivers/net/wireless/iwlwifi/mvm/rs.c