diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-12-06 17:03:17 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-01-03 13:01:18 +0100 |
| commit | 8a57fff0c178febbe28669a0ef68a8e3460a7589 (patch) | |
| tree | aaadc945f5f5c72bd63fe1bbe2d39d0c9eec3ee1 | |
| parent | 10ff57f98d5fccb9bb508ba30230e5df030d67e3 (diff) | |
| download | linux-3.10-8a57fff0c178febbe28669a0ef68a8e3460a7589.tar.gz linux-3.10-8a57fff0c178febbe28669a0ef68a8e3460a7589.tar.bz2 linux-3.10-8a57fff0c178febbe28669a0ef68a8e3460a7589.zip | |
regulatory: don't write past array when intersecting rules
When intersecting rules, we count first to know how many
rules need to be allocated, and then do the intersection
into the allocated array. However, the code doing this
writes past the end of the array because it attempts to
do all intersections. Make it stop when the right number
of rules has been reached.
Acked-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/wireless/reg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 6e5308998e3..40646e823d5 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -647,9 +647,9 @@ static struct ieee80211_regdomain *regdom_intersect( if (!rd) return NULL; - for (x = 0; x < rd1->n_reg_rules; x++) { + for (x = 0; x < rd1->n_reg_rules && rule_idx < num_rules; x++) { rule1 = &rd1->reg_rules[x]; - for (y = 0; y < rd2->n_reg_rules; y++) { + for (y = 0; y < rd2->n_reg_rules && rule_idx < num_rules; y++) { rule2 = &rd2->reg_rules[y]; /* * This time around instead of using the stack lets |