From: Roel Kluin <roel.kluin@gmail.com>
Date: Sun, 2 Aug 2009 07:44:12 +0000 (+0200)
Subject: libertas: Read buffer overflow
X-Git-Tag: v2.6.32-rc1~703^2~275^2~82
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1e3d31c589a6bcb05cd7fccccf9657c27b0e3dd1;p=pandora-kernel.git

libertas: Read buffer overflow

Check whether index is within bounds before testing the element.

(also includes "Libertas: Association request to the driver failed"

The size of the tmp buffer was too small, causing a regression

rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.

In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

Reading git-diff-tree failed