ath9k_htc: Fix array overflow
Use ENDPOINT_MAX instead of HST_ENDPOINT_MAX.
This fixes a stack corruption issue.
This is based on a patch sent by Dan Carpenter <error27@gmail.com>.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.h b/drivers/net/wireless/ath/ath9k/htc_hst.h
index 4f1cdb00..faba679 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.h
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.h
@@ -123,9 +123,6 @@
#define HTC_CONTROL_BUFFER_SIZE \
(HTC_MAX_CONTROL_MESSAGE_LENGTH + sizeof(struct htc_frame_hdr))
-#define NUM_CONTROL_BUFFERS 8
-#define HST_ENDPOINT_MAX 8
-
struct htc_control_buf {
struct htc_packet htc_pkt;
u8 buf[HTC_CONTROL_BUFFER_SIZE];
@@ -139,7 +136,7 @@
struct ath9k_htc_priv *drv_priv;
struct device *dev;
struct ath9k_htc_hif *hif;
- struct htc_endpoint endpoint[HST_ENDPOINT_MAX];
+ struct htc_endpoint endpoint[ENDPOINT_MAX];
struct completion target_wait;
struct completion cmd_wait;
struct list_head list;