Bug 10588

Summary:	[net/wireless/wavelan.c:913]: Array index out of bounds
Product:	Drivers	Reporter:	Daniel Marjamäki (danielm77)
Component:	network-wireless	Assignee:	John W. Linville (linville)
Status:	CLOSED CODE_FIX
Severity:	normal	CC:	bunk
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	2.6.25.1	Subsystem:
Regression:	---	Bisected commit-id:
Attachments:	wavelan-array-overflow.patch

Description Daniel Marjamäki 2008-05-01 23:30:31 UTC

Array index is out of bounds for p->psa_reserved[2] and p->psa_reserved[3].

The psa_reserved array only has 2 elements.

Comment 1 John W. Linville 2008-05-02 06:34:31 UTC

Ah, thanks!

Comment 2 John W. Linville 2008-05-02 06:53:23 UTC

Created attachment 16008 [details]
wavelan-array-overflow.patch

Comment 3 Adrian Bunk 2008-05-14 13:52:48 UTC

fixed by commit d5251aea1539ec89dd567e75169c568b5243b6fa