jurobystricky / Netgear-A6210

AC1200 High Gain WiFi USB Adapter Linux kernel driver
291 stars 155 forks source link

Broken array indexing in sta_ioctl.c:831 #90

Open genodeftest opened 6 years ago

genodeftest commented 6 years ago

From #89:

/home/pi/wifi-src/genodeftest-Netgear-A6210/os/linux/../../os/linux/sta_ioctl.c: In function ‘rt_ioctl_giwscan’:
/home/pi/wifi-src/genodeftest-Netgear-A6210/os/linux/../../os/linux/sta_ioctl.c:831:14: warning: array subscript is below array bounds [-Warray-bounds]
   current_ev = IWE_STREAM_ADD_POINT(info, current_ev, end_buf,&iwe, (char *)pIoctlScan->MainSharedKey[(iwe.u.data.flags & IW_ENCODE_INDEX)-1]);
              ^

This code looks very broken and needs some fixes. Currently, the array index is either ((0x0000 | 0x0800) & 0x00FF) - 1 = (0x0800 & 0x00FF) - 1 = 0x0000 - 1 = -1 or (0x8000 & 0x00FF) - 1 = 0x0000 - 1 = -1 whereas the array has a size of [4][16], so only 0, 1, 2, 3 are allowed.