⬢ DragonFlyBSD Kernel Audit
DF-4619 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar5413.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar5413.c
@@ -492,7 +492,8 @@
 		/*
 		 *-ve ss indicates need to extrapolate data below for this pdGain
 		 */
-		while (ss < 0) {
+		/* NB: pPDADCValues (pcdacTable) has PWR_TABLE_SIZE_2413 entries */
+		while (ss < 0 && kk < PWR_TABLE_SIZE_2413) {
 			tmpVal = (int16_t)(VpdTable_I[ii][0] + ss*Vpd_step);
 			pPDADCValues[kk++] = (uint16_t)((tmpVal < 0) ? 0 : tmpVal);
 			ss++;
@@ -502,7 +503,7 @@
 		tgtIndex = pPdGainBoundaries[ii] + pdGainOverlap_t2 - Pmin_t2[ii];
 		maxIndex = (tgtIndex < sizeCurrVpdTable) ? tgtIndex : sizeCurrVpdTable;
 
-		while (ss < (int16_t)maxIndex)
+		while (ss < (int16_t)maxIndex && kk < PWR_TABLE_SIZE_2413)
 			pPDADCValues[kk++] = VpdTable_I[ii][ss++];
 
 		Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -
@@ -513,7 +514,7 @@
 		 * have to extrapolate
 		 */
 		if (tgtIndex > maxIndex) {	/* need to extrapolate above */
-			while(ss < (int16_t)tgtIndex) {
+			while(ss < (int16_t)tgtIndex && kk < PWR_TABLE_SIZE_2413) {
 				tmpVal = (uint16_t)
 					(VpdTable_I[ii][sizeCurrVpdTable-1] + 
 					 (ss-maxIndex)*Vpd_step);