commit 4a1ff6e2bde56cdf176bd54d557b2e15e819f810
author Patrick McHardy <kaber@trash.net> Sun Mar 12 20:34:53 2006 -0800
committer David S. Miller <davem@sunset.davemloft.net> Sun Mar 12 20:39:39 2006 -0800
tree c831cb72a76e69b3e781f070c510a59b06e39cb9
parent cc9a06cd8d6fbb69b4d3c46760c132cfe312fb85

[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access

Covertiy #547

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/ipv4/tcp_highspeed.c

diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 63cf7e5..e0e9d13 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -125,7 +125,7 @@
 		/* Update AIMD parameters */
 		if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
 			while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-			       ca->ai < HSTCP_AIMD_MAX)
+			       ca->ai < HSTCP_AIMD_MAX - 1)
 				ca->ai++;
 		} else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
 			while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&