sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2025-12-15 09:04:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

[ath9k] Fix buffer overrun for ar9287

Browse Source 
This backport is from linux kernel upstream commit 83d6f1f ("ath9k:
fix buffer overrun for ar9287").

Signed-off-by: Christian Hesse <mail@eworm.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Christian Hesse
2016-05-07 21:20:37 +02:00
committed by Michael Brown
parent 601706688b
commit 858f56e68b
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/drivers/net/ath/ath9k/ath9k_eeprom.c
View File

@@ -368,10 +368,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
if (match) { if (match) {
if (AR_SREV_9287(ah)) { if (AR_SREV_9287(ah)) {
/* FIXME: array overrun? */
for (i = 0; i < numXpdGains; i++) { for (i = 0; i < numXpdGains; i++) {
minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
data_9287[idxL].pwrPdg[i], data_9287[idxL].pwrPdg[i],
data_9287[idxL].vpdPdg[i], data_9287[idxL].vpdPdg[i],
@@ -381,7 +380,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
} else if (eeprom_4k) { } else if (eeprom_4k) {
for (i = 0; i < numXpdGains; i++) { for (i = 0; i < numXpdGains; i++) {
minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
data_4k[idxL].pwrPdg[i], data_4k[idxL].pwrPdg[i],
data_4k[idxL].vpdPdg[i], data_4k[idxL].vpdPdg[i],
@@ -391,7 +390,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
} else { } else {
for (i = 0; i < numXpdGains; i++) { for (i = 0; i < numXpdGains; i++) {
minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
data_def[idxL].pwrPdg[i], data_def[idxL].pwrPdg[i],
data_def[idxL].vpdPdg[i], data_def[idxL].vpdPdg[i],