DragonFlyBSD Kernel Audit
DF-1931 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/netif/ath/ath_rate/amrr/amrr.c b/sys/dev/netif/ath/ath_rate/amrr/amrr.c
--- a/sys/dev/netif/ath/ath_rate/amrr/amrr.c
+++ b/sys/dev/netif/ath/ath_rate/amrr/amrr.c
@@ -244,6 +244,8 @@
 	if (ni->ni_rates.rs_nrates > 0) {
 		ni->ni_txrate = ni->ni_rates.rs_rates[rate] & IEEE80211_RATE_VAL;
 		amn->amn_tx_rix0 = sc->sc_rixmap[ni->ni_txrate];
+		if (amn->amn_tx_rix0 >= rt->rateCount)
+			amn->amn_tx_rix0 = 0;
 		amn->amn_tx_rate0 = rt->info[amn->amn_tx_rix0].rateCode;
 		amn->amn_tx_rate0sp = amn->amn_tx_rate0 |
 			rt->info[amn->amn_tx_rix0].shortPreamble;