⬢ DragonFlyBSD Kernel Audit
DF-4683 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
@@ -380,6 +380,14 @@
 				Pmax_t2[numPdGainsUsed] = 
 					pRawDataset->pDataPerChannel[idxR].pDataPerPDGain[jj].pwr_t4[numVpd-1];
 			Pmax_t2[numPdGainsUsed] = (int16_t)(Pmax_t2[numPdGainsUsed] / 2);
+			/* NB: vpdTable rows are MAX_PWR_RANGE_IN_HALF_DB wide;
+			 * reject inverted (descending EEPROM pwr_t4) or
+			 * oversized curves so FillVpdTable and the interpolate
+			 * loop cannot write past the row / the ar2317State. */
+			if (Pmax_t2[numPdGainsUsed] < Pmin_t2[numPdGainsUsed] ||
+			    (Pmax_t2[numPdGainsUsed] - Pmin_t2[numPdGainsUsed]) >=
+			    MAX_PWR_RANGE_IN_HALF_DB)
+				continue;
 			ar2317FillVpdTable(
 					   numPdGainsUsed, Pmin_t2[numPdGainsUsed], Pmax_t2[numPdGainsUsed], 
 					   &(pRawDataset->pDataPerChannel[idxL].pDataPerPDGain[jj].pwr_t4[0]),