qca / open-ath9k-htc-firmware

The firmware for QCA AR7010/AR9271 802.11n USB NICs
Other
429 stars 182 forks source link

Fix Array Out of Bounds in rcSibUpdate_ht() #55

Closed biergaizi closed 10 years ago

biergaizi commented 10 years ago

In rcSibUpdate_ht(), we clear validPhyRateIndex[WLAN_RC_PHY_MAX][MAX_TX_RATE_PHY] by a for loop.

But, validPhyRateIndex was defined with validPhyRateIndex[WLAN_RC_PHY_MAX][MAX_TX_RATE_TBL], and MAX_TX_RATE_TBL is always greater than MAX_TX_RATE_PHY, caused the out of bounds array access.

This commit corrects MAX_TX_RATE_PHY to MAX_TX_RATE_TBL, and remove MAX_TX_RATE_PHY from ratectrl.h because it is no longer be used.

Signed-off-by: Tom Li biergaizi@member.fsf.org