Commit bb46f130 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

Staging: wlan-ng: off by one in prism2mgmt_scan_results()

Count is used to cap "req->bssindex.data" which is used as an offset
into the hw->scanresults->info.hscanresult.result[] array.  The array
has only HFA384x_SCANRESULT_MAX (31) elements so the 32 is off by one.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0d19cd36
...@@ -380,8 +380,8 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp) ...@@ -380,8 +380,8 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp)
} }
count = (hw->scanresults->framelen - 3) / 32; count = (hw->scanresults->framelen - 3) / 32;
if (count > 32) if (count > HFA384x_SCANRESULT_MAX)
count = 32; count = HFA384x_SCANRESULT_MAX;
if (req->bssindex.data >= count) { if (req->bssindex.data >= count) {
pr_debug("requested index (%d) out of range (%d)\n", pr_debug("requested index (%d) out of range (%d)\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment