From: Roel Kluin Date: Tue, 28 Jul 2009 10:05:00 +0000 (+0200) Subject: libertas: Read buffer overflow X-Git-Tag: v2.6.31-rc6~68^2~30^2~1 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57921c312e8cef72ba35a4cfe870b376da0b1b87;p=pandora-kernel.git libertas: Read buffer overflow Several arrays were read before checking whether the index was within bounds. ARRAY_SIZE() should be used to determine the size of arrays. rates->rates has an arraysize of 1, so calling get_common_rates() with a rates_size of MAX_RATES (14) was causing reads out of bounds. tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1), so that should be the number of elements of tmp[]. A goto can be eliminated: ret was already set upon its declaration. Signed-off-by: Roel Kluin Signed-off-by: John W. Linville --- Reading git-diff-tree failed