• Dan Carpenter's avatar
    mwifiex: prevent an array overflow · b4c35c17
    Dan Carpenter authored
    The "rate_index" is only used as an index into the phist_data->rx_rate[]
    array in the mwifiex_hist_data_set() function.  That array has
    MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some
    debugfs information.  The "rate_index" variable comes from the network
    skb->data[] and it is a u8 so it's in the 0-255 range.  We need to cap
    it to prevent an array overflow.
    
    Fixes: cbf6e055 ("mwifiex: add rx histogram statistics support")
    Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    b4c35c17
cfp.c 14.4 KB