From: Rajkumar Manoharan Date: Tue, 27 Nov 2012 08:21:32 +0000 (+0530) Subject: ath9k: Fix buffer overflow error X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=d6144d85f830848ab31eb5d073d9bb4742b64e03;p=linux-beck.git ath9k: Fix buffer overflow error The commit "ath9k: stomp audio profiles on weak signal strength" failed to take care of new stomp type while programming concurrent tx priority. That leads to array index out of bounds access. drivers/net/wireless/ath/ath9k/btcoex.c:414 ath9k_hw_btcoex_set_concur_txprio() error: buffer overflow 'stomp_txprio' 4 <= 4 Reported-by: Dan Carpenter Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c index 706378ea3ba2..5c02702f21e7 100644 --- a/drivers/net/wireless/ath/ath9k/mci.c +++ b/drivers/net/wireless/ath/ath9k/mci.c @@ -257,8 +257,9 @@ static void ath_mci_set_concur_txprio(struct ath_softc *sc) { struct ath_btcoex *btcoex = &sc->btcoex; struct ath_mci_profile *mci = &btcoex->mci; - u8 stomp_txprio[] = { 0, 0, 0, 0 }; /* all, low, none, low_ftp */ + u8 stomp_txprio[ATH_BTCOEX_STOMP_MAX]; + memset(stomp_txprio, 0, sizeof(stomp_txprio)); if (mci->num_mgmt) { stomp_txprio[ATH_BTCOEX_STOMP_ALL] = ATH_MCI_INQUIRY_PRIO; if (!mci->num_pan && !mci->num_other_acl)