Skip to content

Commit

Permalink
Staging: wlags49_h2: reading past the end of array
Browse files Browse the repository at this point in the history
The original code had some confusion about the dimensions of the array.
It should have been an array of 2 element arrays but it was declared as
an array of 50 element arrays.

The limitter on the outside array should have been
ARRAY_SIZE(chan_freq_list) or 26 but instead 50 was used.  It meant that
we read past the end.  It's probably harmless but it's obviously worth
fixing.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Apr 18, 2012
1 parent 1ae5062 commit fdf3480
Showing 1 changed file with 5 additions and 6 deletions.
11 changes: 5 additions & 6 deletions drivers/staging/wlags49_h2/wl_util.c
Original file line number Diff line number Diff line change
Expand Up @@ -98,8 +98,7 @@
******************************************************************************/

/* A matrix which maps channels to frequencies */
#define MAX_CHAN_FREQ_MAP_ENTRIES 50
static const long chan_freq_list[][MAX_CHAN_FREQ_MAP_ENTRIES] =
static const long chan_freq_list[][2] =
{
{1,2412},
{2,2417},
Expand Down Expand Up @@ -846,7 +845,7 @@ int wl_is_a_valid_chan( int channel )
}

/* Iterate through the matrix and retrieve the frequency */
for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
for( i = 0; i < ARRAY_SIZE(chan_freq_list); i++ ) {
if( chan_freq_list[i][0] == channel ) {
return 1;
}
Expand Down Expand Up @@ -884,7 +883,7 @@ int wl_is_a_valid_freq( long frequency )


/* Iterate through the matrix and retrieve the channel */
for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
for( i = 0; i < ARRAY_SIZE(chan_freq_list); i++ ) {
if( chan_freq_list[i][1] == frequency ) {
return 1;
}
Expand Down Expand Up @@ -927,7 +926,7 @@ long wl_get_freq_from_chan( int channel )
}

/* Iterate through the matrix and retrieve the frequency */
for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
for( i = 0; i < ARRAY_SIZE(chan_freq_list); i++ ) {
if( chan_freq_list[i][0] == channel ) {
return chan_freq_list[i][1];
}
Expand Down Expand Up @@ -965,7 +964,7 @@ int wl_get_chan_from_freq( long frequency )


/* Iterate through the matrix and retrieve the channel */
for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
for( i = 0; i < ARRAY_SIZE(chan_freq_list); i++ ) {
if( chan_freq_list[i][1] == frequency ) {
return chan_freq_list[i][0];
}
Expand Down

0 comments on commit fdf3480

Please sign in to comment.