Roel Kluin 57921c312e libertas: Read buffer overflow
Several arrays were read before checking whether the index was within
bounds. ARRAY_SIZE() should be used to determine the size of arrays.

rates->rates has an arraysize of 1, so calling get_common_rates()
with a rates_size of MAX_RATES (14) was causing reads out of bounds.

tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) *
(*rates_size - 1), so that should be the number of elements of tmp[].

A goto can be eliminated: ret was already set upon its declaration.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-07-29 14:52:01 -04:00
..
2009-07-27 15:19:36 -04:00
2009-07-08 15:24:24 -04:00
2009-07-27 15:19:35 -04:00
2009-07-29 14:52:01 -04:00
2009-03-16 18:09:35 -04:00
2009-07-27 15:19:36 -04:00
2009-02-27 14:52:44 -05:00