libertas: Read buffer overflow
Check whether index is within bounds before testing the element.
(also includes "Libertas: Association request to the driver failed"
The size of the tmp buffer was too small, causing a regression
rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.
In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
1 file changed