mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-24 03:24:55 +08:00
mwifiex: avoid out of bounds access in mwifiex_get_common_rates.
Check that the array indexes are in-bounds before accessing the rate2 and tmp arrays. Found with the following semantic patch: <smpl> @@ identifier t; identifier idx; expression E; statement S; @@ * for (... ; <+... t[idx] ...+> && idx < E ; ...) S </smpl> Signed-off-by: Cyril Roelandt <tipecaml@gmail.com> Acked-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
44ba973699
commit
485f107d34
@ -157,8 +157,8 @@ static int mwifiex_get_common_rates(struct mwifiex_private *priv, u8 *rate1,
|
||||
|
||||
memset(rate1, 0, rate1_size);
|
||||
|
||||
for (i = 0; rate2[i] && i < rate2_size; i++) {
|
||||
for (j = 0; tmp[j] && j < rate1_size; j++) {
|
||||
for (i = 0; i < rate2_size && rate2[i]; i++) {
|
||||
for (j = 0; j < rate1_size && tmp[j]; j++) {
|
||||
/* Check common rate, excluding the bit for
|
||||
basic rate */
|
||||
if ((rate2[i] & 0x7F) == (tmp[j] & 0x7F)) {
|
||||
|
Loading…
Reference in New Issue
Block a user