diff options
| author | Malcolm Priestley <tvboxspy@gmail.com> | 2015-01-19 18:24:14 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-01-25 11:59:16 (GMT) |
| commit | b0c5881e78b31ff7e90fb8fef23d65c078fec18e (patch) | |
| tree | fed4505c49eb2942cb46dd6ef370aa65176cd728 | |
| parent | 918185f6662379f570e29c86c0229d8036ef4fa7 (diff) | |
| download | linux-b0c5881e78b31ff7e90fb8fef23d65c078fec18e.tar.xz | |
staging: vt6655: Fix RFbSetPower() error: buffer overflow 'priv->abyCCKPwrTbl' 15 <= 56
Check uCH is not more than CB_MAX_CHANNEL_24G(14) on rates RATE_1M to RATE_11M
Return false as the call is invalid as these rates do not exist
above channel 14.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/vt6655/rf.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c index 27841aa..a6eabde 100644 --- a/drivers/staging/vt6655/rf.c +++ b/drivers/staging/vt6655/rf.c @@ -788,6 +788,9 @@ bool RFbSetPower( case RATE_2M: case RATE_5M: case RATE_11M: + if (uCH > CB_MAX_CHANNEL_24G) + return false; + byPwr = priv->abyCCKPwrTbl[uCH]; byPwrdBm = priv->abyCCKDefaultPwr[uCH]; break; |