⬢ DragonFlyBSD Kernel Audit
DF-4620 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar5413.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar5413.c
@@ -465,6 +465,19 @@
 		/* if this pdGain is used */
 	}
 
+	if (numPdGainsUsed == 0) {
+		/*
+		 * EEPROM supplied no pd gain data for this channel
+		 * (e.g. xpd_mask == 0).  Bail out: continuing would read
+		 * pPdGainBoundaries[ii-1] and pPDADCValues[kk-1] with
+		 * ii == kk == 0 (uint32 wrap to 0xFFFFFFFF => read at
+		 * array + 0x1FFFFFFFE bytes) plus the uninitialized
+		 * Pmin_t2[0] below.
+		 */
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: no pd gain data\n", __func__);
+		return 0;
+	}
+
 	*pMinCalPower = Pmin_t2[0];
 	kk = 0; /* index for the final table */
 	for (ii = 0; ii < numPdGainsUsed; ii++) {
@@ -578,6 +591,8 @@
 	numPdGainsUsed = ar5413getGainBoundariesAndPdadcsForPowers(ah,
 		freq, pRawDataset, pdGainOverlap_t2,
 		&minCalPower5413_t2,gainBoundaries, rfXpdGain, pdadcValues);
+	if (numPdGainsUsed == 0)
+		return AH_FALSE;
 	HALASSERT(1 <= numPdGainsUsed && numPdGainsUsed <= 3);
 
 #ifdef AH_USE_INIPDGAIN