提交 522536f6 编写于 作者: L Larry Finger 提交者: John W. Linville

[PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise

An assert statement near the start of handle_irq_noise in the softmac
version of bcm43xx_main.c is there to protect against out of bound
addressing using variable bcm->noisecalc.nr_samples. The arrays in
question have a dimension of 8, thus the value must be < 8.
Signed-Off-By: NLarry.Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 120bda20
...@@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm) ...@@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm)
goto generate_new; goto generate_new;
/* Get the noise samples. */ /* Get the noise samples. */
assert(bcm->noisecalc.nr_samples <= 8); assert(bcm->noisecalc.nr_samples < 8);
i = bcm->noisecalc.nr_samples; i = bcm->noisecalc.nr_samples;
noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册