libertas: Read buffer overflow
authorRoel Kluin <roel.kluin@gmail.com>
Sun, 2 Aug 2009 07:44:12 +0000 (09:44 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Fri, 28 Aug 2009 18:40:35 +0000 (14:40 -0400)
commit1e3d31c589a6bcb05cd7fccccf9657c27b0e3dd1
treee8a3cee9d0e1680a06db7b557bae254d465c912d
parent1c4e9ab3f1cc458306b3b910000371ba4f71c4d2
libertas: Read buffer overflow

Check whether index is within bounds before testing the element.

(also includes "Libertas: Association request to the driver failed"

The size of the tmp buffer was too small, causing a regression

rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.

In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/libertas/assoc.c