Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1207266

[PATCH] iwlwifi: out-of-bounds access in iwl_init_sband_channels

Show all headers | View raw

Both loops of this function compare data from the 'chan' array and then
check if the index is valid.

The 2 conditions should be inverted to avoid an out-of-bounds access.

Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
---
 drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 21302b6..acc3d18 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -713,12 +713,12 @@ int iwl_init_sband_channels(struct iwl_nvm_data *data,
 	struct ieee80211_channel *chan = &data->channels[0];
 	int n = 0, idx = 0;
 
-	while (chan->band != band && idx < n_channels)
+	while (idx < n_channels && chan->band != band)
 		chan = &data->channels[++idx];
 
 	sband->channels = &data->channels[idx];
 
-	while (chan->band == band && idx < n_channels) {
+	while (idx < n_channels && chan->band == band) {
 		chan = &data->channels[++idx];
 		n++;
 	}
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] iwlwifi: out-of-bounds access in iwl_init_sband_channels Adrien Schildknecht <adrien+dev@schischi.me> - 2015-08-14 02:40 +0200
  Re: [PATCH] iwlwifi: out-of-bounds access in iwl_init_sband_channels "Grumbach, Emmanuel" <emmanuel.grumbach@intel.com> - 2015-08-14 06:40 +0200
    Re: [PATCH] iwlwifi: out-of-bounds access in  iwl_init_sband_channels Adrien Schildknecht <adrien+dev@schischi.me> - 2015-08-14 09:10 +0200
      Re: [PATCH] iwlwifi: out-of-bounds access in iwl_init_sband_channels Kalle Valo <kvalo@codeaurora.org> - 2015-08-14 09:20 +0200
        [PATCH v2] iwlwifi: out-of-bounds access in iwl_init_sband_channels Adrien Schildknecht <adrien+dev@schischi.me> - 2015-08-14 11:10 +0200

csiph-web