summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/mwifiex/join.c
diff options
context:
space:
mode:
authorCyril Roelandt <tipecaml@gmail.com>2013-01-27 23:42:48 +0100
committerJohn W. Linville <linville@tuxdriver.com>2013-01-30 15:07:09 -0500
commit485f107d341cb1d09e010e0466b02a1ad026f489 (patch)
tree7d78c7f246caff67d150b71126dde6bbe83b6020 /drivers/net/wireless/mwifiex/join.c
parent44ba973699b831414c3f8eef68ee5a7fe1208a05 (diff)
downloadlwn-485f107d341cb1d09e010e0466b02a1ad026f489.tar.gz
lwn-485f107d341cb1d09e010e0466b02a1ad026f489.zip
mwifiex: avoid out of bounds access in mwifiex_get_common_rates.
Check that the array indexes are in-bounds before accessing the rate2 and tmp arrays. Found with the following semantic patch: <smpl> @@ identifier t; identifier idx; expression E; statement S; @@ * for (... ; <+... t[idx] ...+> && idx < E ; ...) S </smpl> Signed-off-by: Cyril Roelandt <tipecaml@gmail.com> Acked-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex/join.c')
-rw-r--r--drivers/net/wireless/mwifiex/join.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 893d809ba83c..f0a634d237c1 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -157,8 +157,8 @@ static int mwifiex_get_common_rates(struct mwifiex_private *priv, u8 *rate1,
memset(rate1, 0, rate1_size);
- for (i = 0; rate2[i] && i < rate2_size; i++) {
- for (j = 0; tmp[j] && j < rate1_size; j++) {
+ for (i = 0; i < rate2_size && rate2[i]; i++) {
+ for (j = 0; j < rate1_size && tmp[j]; j++) {
/* Check common rate, excluding the bit for
basic rate */
if ((rate2[i] & 0x7F) == (tmp[j] & 0x7F)) {