⬢ DragonFlyBSD Kernel Audit
DF-4687 / fixD.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c	2026-09-22 21:03:53.562340809 +0000
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c	2026-09-22 21:03:53.562340809 +0000
@@ -406,6 +406,15 @@
 				Pmax_t2[numPdGainsUsed] = 
 					pRawDataset->pDataPerChannel[idxR].pDataPerPDGain[jj].pwr_t4[numVpd-1];
 			Pmax_t2[numPdGainsUsed] = (int16_t)(Pmax_t2[numPdGainsUsed] / 2);
+			/* NB: the VpdTable rows are MAX_PWR_RANGE_IN_HALF_DB wide
+			 * and the scratch lives in kernel static storage;
+			 * reject inverted (descending EEPROM pwr_t4) or
+			 * oversized curves so FillVpdTable and the interpolate
+			 * loop cannot write past the row / off the block. */
+			if (Pmax_t2[numPdGainsUsed] < Pmin_t2[numPdGainsUsed] ||
+			    (Pmax_t2[numPdGainsUsed] - Pmin_t2[numPdGainsUsed]) >=
+			    MAX_PWR_RANGE_IN_HALF_DB)
+				continue;
 			ar2425FillVpdTable(
 					   numPdGainsUsed, Pmin_t2[numPdGainsUsed], Pmax_t2[numPdGainsUsed], 
 					   &(pRawDataset->pDataPerChannel[idxL].pDataPerPDGain[jj].pwr_t4[0]),