Staging: wlan-ng: off by one in prism2mgmt_scan_results()

Count is used to cap "req->bssindex.data" which is used as an offset
into the hw->scanresults->info.hscanresult.result[] array.  The array
has only HFA384x_SCANRESULT_MAX (31) elements so the 32 is off by one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c
index c3bb05d..4efa9bc 100644 (file)
--- a/drivers/staging/wlan-ng/prism2mgmt.c
+++ b/drivers/staging/wlan-ng/prism2mgmt.c
@@ -380,8 +380,8 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp)
        }
 
        count = (hw->scanresults->framelen - 3) / 32;
-       if (count > 32)
-               count = 32;
+       if (count > HFA384x_SCANRESULT_MAX)
+               count = HFA384x_SCANRESULT_MAX;
 
        if (req->bssindex.data >= count) {
                pr_debug("requested index (%d) out of range (%d)\n",