diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-04-18 06:48:59 (GMT) |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-04-18 23:59:03 (GMT) |
commit | bb46f130a033ed812ccc24f5fd4f34648650d240 (patch) | |
tree | e750c3eb638b4077a9a04551c6a193af307a9815 /drivers/staging/wlan-ng | |
parent | 0d19cd36a5727962b3c000270857d4bf63522d63 (diff) | |
download | linux-bb46f130a033ed812ccc24f5fd4f34648650d240.tar.xz |
Staging: wlan-ng: off by one in prism2mgmt_scan_results()
Count is used to cap "req->bssindex.data" which is used as an offset
into the hw->scanresults->info.hscanresult.result[] array. The array
has only HFA384x_SCANRESULT_MAX (31) elements so the 32 is off by one.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/wlan-ng')
-rw-r--r-- | drivers/staging/wlan-ng/prism2mgmt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c index c3bb05d..4efa9bc 100644 --- a/drivers/staging/wlan-ng/prism2mgmt.c +++ b/drivers/staging/wlan-ng/prism2mgmt.c @@ -380,8 +380,8 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp) } count = (hw->scanresults->framelen - 3) / 32; - if (count > 32) - count = 32; + if (count > HFA384x_SCANRESULT_MAX) + count = HFA384x_SCANRESULT_MAX; if (req->bssindex.data >= count) { pr_debug("requested index (%d) out of range (%d)\n", |