⬢ DragonFlyBSD Kernel Audit
DF-4680 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
@@ -429,7 +429,8 @@
 		/*
 		 *-ve ss indicates need to extrapolate data below for this pdGain
 		 */
-		while (ss < 0) {
+		/* NB: pPDADCValues (pcdacTable) has PWR_TABLE_SIZE_2317 entries */
+		while (ss < 0 && kk < PWR_TABLE_SIZE_2317) {
 			tmpVal = (int16_t)(VpdTable_I[ii][0] + ss*Vpd_step);
 			pPDADCValues[kk++] = (uint16_t)((tmpVal < 0) ? 0 : tmpVal);
 			ss++;
@@ -439,7 +440,7 @@
 		tgtIndex = pPdGainBoundaries[ii] + pdGainOverlap_t2 - Pmin_t2[ii];
 		maxIndex = (tgtIndex < sizeCurrVpdTable) ? tgtIndex : sizeCurrVpdTable;
 
-		while (ss < (int16_t)maxIndex)
+		while (ss < (int16_t)maxIndex && kk < PWR_TABLE_SIZE_2317)
 			pPDADCValues[kk++] = VpdTable_I[ii][ss++];
 
 		Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -
@@ -450,7 +451,7 @@
 		 * have to extrapolate
 		 */
 		if (tgtIndex > maxIndex) {	/* need to extrapolate above */
-			while(ss < (int16_t)tgtIndex) {
+			while(ss < (int16_t)tgtIndex && kk < PWR_TABLE_SIZE_2317) {
 				tmpVal = (uint16_t)
 					(VpdTable_I[ii][sizeCurrVpdTable-1] + 
 					 (ss-maxIndex)*Vpd_step);