xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iwlwifi: mvm: rs: fix a potential out of bounds access

Browse Source 
Klocwork pointed these out. There is a theoretical possibility
that rate->index might be set to IWL_RATE_INVALID (15).
This could trigger an out of bounds access on ht_vht_rates or
legacy_rates arrays. Fix it by adding some checks.

Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This commit is contained in:
Eyal Shapira
2015-11-19 18:37:31 +02:00
committed by Emmanuel Grumbach
parent 355346ba30
commit e8b3f7b6e7
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/intel/iwlwifi/mvm/rs.c
View File

@@ -552,9 +552,10 @@ static char *rs_pretty_rate(const struct rs_rate *rate)
};
const char *rate_str;
if (is_type_legacy(rate->type))
if (is_type_legacy(rate->type) && (rate->index <= IWL_RATE_54M_INDEX))
rate_str = legacy_rates[rate->index];
else if (is_type_ht(rate->type) || is_type_vht(rate->type))
else if ((is_type_ht(rate->type) || is_type_vht(rate->type)) &&
(rate->index <= IWL_RATE_MCS_9_INDEX))
rate_str = ht_vht_rates[rate->index];
else
rate_str = "BAD_RATE";