lkml.org 
[lkml]   [2009]   [Feb]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [ath5k-devel] [PATCH 1/1] ath5k: fix hw rate index condition
    From
    On Thu, Feb 26, 2009 at 6:19 PM, Jiri Slaby <jirislaby@gmail.com> wrote:
    > On 27.2.2009 00:15, Bob Copeland wrote:
    >> Speaking of, I think there's another potential oob array access at:
    >>
    >> if (rxs.rate_idx>= 0&&  rs.rs_rate ==
    >>      sc->curband->bitrates[rxs.rate_idx].hw_value_short)
    >>          rxs.flag |= RX_FLAG_SHORTPRE;
    >>
    >> because sc->rate_idx is u8 instead of s8.
    >
    > strcmp("sc->rate_idx", "rxs.rate_idx") != 0 :)
    >
    > Or did I miss something?

    :) Sorry, I should've been clearer.

    hw_to_driver_rix() returns sc->rate_idx[x][y] as an int, and that
    array is initialized to (u8)-1 for invalid rates. So, it can
    return 255 if the hardware rate index (y) is bad, then the check
    "rxs.rate_idx >= 0" would always be true, right? If it's not a
    real bug yet, it likely will be one day :)

    --
    Bob Copeland %% www.bobcopeland.com
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-02-27 00:31    [W:0.032 / U:1.268 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site