⬢ DragonFlyBSD Kernel Audit
DF-4661 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2413.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2413.c
@@ -420,7 +420,20 @@
 		}
 		/* if this pdGain is used */
 	}
 
+	if (numPdGainsUsed == 0) {
+		/*
+		 * EEPROM supplied no pd gain data for this channel
+		 * (e.g. xpd_mask == 0 => every numVpd == 0).  Bail out:
+		 * continuing would read pPdGainBoundaries[ii-1] and
+		 * pPDADCValues[kk-1] with ii == kk == 0 (uint32 wrap to
+		 * 0xFFFFFFFF => read at array + 0x1FFFFFFFE bytes) plus
+		 * the uninitialized Pmin_t2[0] below.
+		 */
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: no pd gain data\n", __func__);
+		return 0;
+	}
+
 	*pMinCalPower = Pmin_t2[0];
 	kk = 0; /* index for the final table */
 	for (ii = 0; ii < numPdGainsUsed; ii++) {
@@ -533,6 +546,8 @@
 	numPdGainsUsed = ar2413getGainBoundariesAndPdadcsForPowers(ah,
 		freq, pRawDataset, pdGainOverlap_t2,
 		&minCalPower2413_t2,gainBoundaries, rfXpdGain, pdadcValues);
+	if (numPdGainsUsed == 0)
+		return AH_FALSE;
 	HALASSERT(1 <= numPdGainsUsed && numPdGainsUsed <= 3);
 
 #ifdef AH_USE_INIPDGAIN