]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ray_cs: fix array out-of-bounds access
authorColin Ian King <colin.king@canonical.com>
Thu, 20 Dec 2018 14:05:50 +0000 (14:05 +0000)
committerKalle Valo <kvalo@codeaurora.org>
Thu, 10 Jan 2019 11:32:40 +0000 (13:32 +0200)
commit72255c807156adeb167444c4206c9e5eece22287
tree2db0328e870a94eec8574bf7aa0f89f1a1582c3b
parentba2ffc96321c8433606ceeb85c9e722b8113e5a7
ray_cs: fix array out-of-bounds access

Currently array element org[3] is being accessed, however the array is
only 3 elements in size, so this looks like an off-by-one out-of-bounds
error. Fix this by using org[2], which I believe was the original
intent.

This issue has existed in the driver back in the pre-git days, so no
idea when it was introduced.

Detected by CoverityScan, CID#711344 ("Out-of-bounds read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/ray_cs.c