From: Larry Finger Date: Thu, 29 Jun 2006 00:11:21 +0000 (-0500) Subject: [PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise X-Git-Tag: v2.6.18-rc2~101^2~14^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=522536f6b24e63ac946259af65224f107dff7857;p=profile%2Fivi%2Fkernel-adaptation-intel-automotive.git [PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise An assert statement near the start of handle_irq_noise in the softmac version of bcm43xx_main.c is there to protect against out of bound addressing using variable bcm->noisecalc.nr_samples. The arrays in question have a dimension of 8, thus the value must be < 8. Signed-Off-By: Larry.Finger Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c index e1c5a93..3889f79 100644 --- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c +++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c @@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm) goto generate_new; /* Get the noise samples. */ - assert(bcm->noisecalc.nr_samples <= 8); + assert(bcm->noisecalc.nr_samples < 8); i = bcm->noisecalc.nr_samples; noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);