| commit | 082e708acc50a5b625b9bde0bb1af90dfdbd1942 | |
| author | Roel Kluin <roel.kluin@gmail.com> | |
| Sat, 25 Jul 2009 21:34:31 +0000 (25 23:34 +0200) | ||
| committer | John W. Linville <linville@tuxdriver.com> | |
| Mon, 27 Jul 2009 19:19:37 +0000 (27 15:19 -0400) | ||
| tree | 71fcce74adf2a0c53057942eedbb15bf24b96e9e | treesnapshot (tar.gz zip) |
| parent | 008749fc9917b799c469478141ddd1a4c81d06ca | commitdiff |
iwlwifi: Read outside array bounds
tid is bounded (above) by the size of default_tid_to_tx_fifo (17 elements), but
the size of priv->stations[].tid[] is MAX_TID_COUNT (9) elements.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
tid is bounded (above) by the size of default_tid_to_tx_fifo (17 elements), but
the size of priv->stations[].tid[] is MAX_TID_COUNT (9) elements.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| drivers/net/wireless/iwlwifi/iwl-tx.c | diffblobblamehistory |