mwifiex: fix invalid memory access in mwifiex_ret_tx_rate_cfg()

Browse source

As tlv_buf_len is decremented at the end of the loop, we may have
accessed invalid memory in the last iteration.
Modify the while condition and add a break statement at the
begining of the loop to fix the problem.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

...

This commit is contained in:

Amitkumar Karwar 2013-10-22 15:24:45 -07:00 • committed by John W. Linville

parent fe1c9a443e

commit 2636c308fd

1 changed files with 12 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/net/wireless/mwifiex/sta_cmdresp.c

View file