staging: vt6656: vnt_rf_setpower rate <= RATE_11M check array bound

decrement channel by one and check array bound.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
index 971f844..4124131 100644 (file)
--- a/drivers/staging/vt6656/rf.c
+++ b/drivers/staging/vt6656/rf.c
@@ -744,7 +744,10 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
        case RATE_2M:
        case RATE_5M:
        case RATE_11M:
-               power = priv->abyCCKPwrTbl[channel-1];
+               channel--;
+
+               if (channel < sizeof(priv->abyCCKPwrTbl))
+                       power = priv->abyCCKPwrTbl[channel];
                break;
        case RATE_6M:
        case RATE_9M: