⬢ DragonFlyBSD Kernel Audit
DF-4687 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c	2026-09-22 21:03:53.530341227 +0000
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c	2026-09-22 21:03:53.550340965 +0000
@@ -449,7 +449,8 @@
 		/*
 		 *-ve ss indicates need to extrapolate data below for this pdGain
 		 */
-		while (ss < 0) {
+		/* NB: pPDADCValues (pcdacTable) has PWR_TABLE_SIZE_2413 entries */
+		while (ss < 0 && kk < PWR_TABLE_SIZE_2413) {
 			tmpVal = (int16_t)(VpdTable_I[ii][0] + ss*Vpd_step);
 			pPDADCValues[kk++] = (uint16_t)((tmpVal < 0) ? 0 : tmpVal);
 			ss++;
@@ -459,7 +460,7 @@
 		tgtIndex = pPdGainBoundaries[ii] + pdGainOverlap_t2 - Pmin_t2[ii];
 		maxIndex = (tgtIndex < sizeCurrVpdTable) ? tgtIndex : sizeCurrVpdTable;
 
-		while (ss < (int16_t)maxIndex)
+		while (ss < (int16_t)maxIndex && kk < PWR_TABLE_SIZE_2413)
 			pPDADCValues[kk++] = VpdTable_I[ii][ss++];
 
 		Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -
@@ -470,7 +471,7 @@
 		 * have to extrapolate
 		 */
 		if (tgtIndex > maxIndex) {	/* need to extrapolate above */
-			while(ss < (int16_t)tgtIndex) {
+			while(ss < (int16_t)tgtIndex && kk < PWR_TABLE_SIZE_2413) {
 				tmpVal = (uint16_t)
 					(VpdTable_I[ii][sizeCurrVpdTable-1] + 
 					 (ss-maxIndex)*Vpd_step);