File ipxe.858f56e68b7089a3dc8473bb94dd198554a24eeb.p... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File ipxe.858f56e68b7089a3dc8473bb94dd198554a24eeb.patch of Package xen (Revision 9c19b2ac2b72c8989bd52e3b7b9c28ae)

Currently displaying revision 9c19b2ac2b72c8989bd52e3b7b9c28ae , Show latest

From: Christian Hesse <mail@eworm.de>
Date: Sat, 7 May 2016 21:20:37 +0200
Subject: 858f56e68b7089a3dc8473bb94dd198554a24eeb

[ath9k] Fix buffer overrun for ar9287

This backport is from linux kernel upstream commit 83d6f1f ("ath9k:
fix buffer overrun for ar9287").

Signed-off-by: Christian Hesse <mail@eworm.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/drivers/net/ath/ath9k/ath9k_eeprom.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/src/drivers/net/ath/ath9k/ath9k_eeprom.c
+++ b/src/drivers/net/ath/ath9k/ath9k_eeprom.c
@@ -359,48 +359,47 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
 
 	for (numPiers = 0; numPiers < availPiers; numPiers++) {
 		if (bChans[numPiers] == AR5416_BCHAN_UNUSED)
 			break;
 	}
 
 	match = ath9k_hw_get_lower_upper_index((u8)FREQ2FBIN(centers.synth_center,
 							     IS_CHAN_2GHZ(chan)),
 					       bChans, numPiers, &idxL, &idxR);
 
 	if (match) {
 		if (AR_SREV_9287(ah)) {
-			/* FIXME: array overrun? */
 			for (i = 0; i < numXpdGains; i++) {
 				minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
-				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
+				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
 						data_9287[idxL].pwrPdg[i],
 						data_9287[idxL].vpdPdg[i],
 						intercepts,
 						vpdTableI[i]);
 			}
 		} else if (eeprom_4k) {
 			for (i = 0; i < numXpdGains; i++) {
 				minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
-				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
+				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
 						data_4k[idxL].pwrPdg[i],
 						data_4k[idxL].vpdPdg[i],
 						intercepts,
 						vpdTableI[i]);
 			}
 		} else {
 			for (i = 0; i < numXpdGains; i++) {
 				minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
-				maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
+				maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
 						data_def[idxL].pwrPdg[i],
 						data_def[idxL].vpdPdg[i],
 						intercepts,
 						vpdTableI[i]);
 			}
 		}
 	} else {
 		for (i = 0; i < numXpdGains; i++) {
 			if (AR_SREV_9287(ah)) {
 				pVpdL = data_9287[idxL].vpdPdg[i];
 				pPwrL = data_9287[idxL].pwrPdg[i];

Places

File ipxe.858f56e68b7089a3dc8473bb94dd198554a24eeb.patch of Package xen (Revision 9c19b2ac2b72c8989bd52e3b7b9c28ae)

Places