⬢ DragonFlyBSD Kernel Audit
DF-4682 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
@@ -442,17 +442,23 @@
 		while (ss < (int16_t)maxIndex)
 			pPDADCValues[kk++] = VpdTable_I[ii][ss++];
 
-		Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -
-				       VpdTable_I[ii][sizeCurrVpdTable-2]);
-		Vpd_step = (uint16_t)((Vpd_step < 1) ? 1 : Vpd_step);           
+		if (sizeCurrVpdTable >= 2) {
+			Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -
+					       VpdTable_I[ii][sizeCurrVpdTable-2]);
+			Vpd_step = (uint16_t)((Vpd_step < 1) ? 1 : Vpd_step);
+		} else {
+			Vpd_step = 1;	/* flat curve: no step available */
+		}
 		/*
 		 * for last gain, pdGainBoundary == Pmax_t2, so will 
 		 * have to extrapolate
 		 */
 		if (tgtIndex > maxIndex) {	/* need to extrapolate above */
+			uint32_t vpdLastIdx = (sizeCurrVpdTable >= 1) ?
+			    sizeCurrVpdTable - 1 : 0;
 			while(ss < (int16_t)tgtIndex) {
 				tmpVal = (uint16_t)
-					(VpdTable_I[ii][sizeCurrVpdTable-1] + 
+					(VpdTable_I[ii][vpdLastIdx] + 
 					 (ss-maxIndex)*Vpd_step);
 				pPDADCValues[kk++] = (tmpVal > 127) ? 
 					127 : tmpVal;