提交 e8b3f7b6 编写于 作者: E Eyal Shapira 提交者: Emmanuel Grumbach

iwlwifi: mvm: rs: fix a potential out of bounds access

Klocwork pointed these out. There is a theoretical possibility
that rate->index might be set to IWL_RATE_INVALID (15).
This could trigger an out of bounds access on ht_vht_rates or
legacy_rates arrays. Fix it by adding some checks.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
上级 355346ba
...@@ -552,9 +552,10 @@ static char *rs_pretty_rate(const struct rs_rate *rate) ...@@ -552,9 +552,10 @@ static char *rs_pretty_rate(const struct rs_rate *rate)
}; };
const char *rate_str; const char *rate_str;
if (is_type_legacy(rate->type)) if (is_type_legacy(rate->type) && (rate->index <= IWL_RATE_54M_INDEX))
rate_str = legacy_rates[rate->index]; rate_str = legacy_rates[rate->index];
else if (is_type_ht(rate->type) || is_type_vht(rate->type)) else if ((is_type_ht(rate->type) || is_type_vht(rate->type)) &&
(rate->index <= IWL_RATE_MCS_9_INDEX))
rate_str = ht_vht_rates[rate->index]; rate_str = ht_vht_rates[rate->index];
else else
rate_str = "BAD_RATE"; rate_str = "BAD_RATE";
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册