⬢ DragonFlyBSD Kernel Audit
DF-4141 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
diff --git a/sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c b/sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c
--- a/sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c
+++ b/sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c
@@ -1534,19 +1534,24 @@
 		}
 		numEdges = i;
 
-		ar5211GetLowerUpperValues(freq, tempChannelList,
-			numEdges, &lowerChannel, &upperChannel);
-		/* Get the index for this channel */
-		for (i = 0; i < numEdges; i++)
-			if (lowerChannel == tempChannelList[i])
-				break;
-		HALASSERT(i != numEdges);
-
-		if ((lowerChannel == upperChannel &&
-		     lowerChannel == freq) ||
-		    pRdEdgesPower[i].flag) {
-			twiceMaxEdgePower = pRdEdgesPower[i].twice_rdEdgePower;
-			HALASSERT(twiceMaxEdgePower > 0);
+		/* DF-4141: a blanked edge row leaves numEdges == 0; skip the
+		 * interpolation instead of reading below tempChannelList */
+		if (numEdges > 0) {
+			ar5211GetLowerUpperValues(freq, tempChannelList,
+				numEdges, &lowerChannel, &upperChannel);
+			/* Get the index for this channel */
+			for (i = 0; i < numEdges; i++)
+				if (lowerChannel == tempChannelList[i])
+					break;
+			HALASSERT(i != numEdges);
+
+			if ((lowerChannel == upperChannel &&
+			     lowerChannel == freq) ||
+			    pRdEdgesPower[i].flag) {
+				twiceMaxEdgePower =
+				    pRdEdgesPower[i].twice_rdEdgePower;
+				HALASSERT(twiceMaxEdgePower > 0);
+			}
 		}
 	}
 
@@ -1815,13 +1820,17 @@
 	const uint16_t *pList, uint16_t listSize,
 	uint16_t *pLowerValue, uint16_t *pUpperValue)
 {
-	const uint16_t listEndValue = *(pList + listSize - 1);
+	const uint16_t listEndValue = listSize ? *(pList + listSize - 1) : 0;
 	uint32_t target = value * EEP_SCALE;
 	int i;
 
 	*pLowerValue = 0;	/* avoid gcc warnings */
 	*pUpperValue = 0;	/* avoid gcc warnings */
 
+	/* DF-4141: empty pier list -- nothing to interpolate */
+	if (listSize == 0)
+		return;
+
 	/*
 	 * See if value is lower than the first value in the list
 	 * if so return first value