libertas: Read buffer overflow

Browse source

Check whether index is within bounds before testing the element.

(also includes "Libertas: Association request to the driver failed"

The size of the tmp buffer was too small, causing a regression

rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.

In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

...

This commit is contained in:

Roel Kluin 2009-08-02 09:44:12 +02:00 • committed by John W. Linville

parent 1c4e9ab3f1

commit 1e3d31c589

1 changed files with 15 additions and 16 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

31

drivers/net/wireless/libertas/assoc.c

View file