From: Malcolm Priestley <tvboxspy@gmail.com>
Date: Sat, 5 Jul 2014 18:24:22 +0000 (+0100)
Subject: staging: vt6656: vnt_rf_setpower rate <= RATE_11M check array bound
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=89daee6ff54172c147bcbdad60c8b8db141c8d20;p=linux-beck.git

staging: vt6656: vnt_rf_setpower rate <= RATE_11M check array bound

decrement channel by one and check array bound.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
index 971f84480117..4124131fba20 100644
--- a/drivers/staging/vt6656/rf.c
+++ b/drivers/staging/vt6656/rf.c
@@ -744,7 +744,10 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
 	case RATE_2M:
 	case RATE_5M:
 	case RATE_11M:
-		power = priv->abyCCKPwrTbl[channel-1];
+		channel--;
+
+		if (channel < sizeof(priv->abyCCKPwrTbl))
+			power = priv->abyCCKPwrTbl[channel];
 		break;
 	case RATE_6M:
 	case RATE_9M: