diff options
| author | Gleydson Soares <gsoares@cvs.openbsd.org> | 2011-10-29 12:18:15 +0000 |
|---|---|---|
| committer | Gleydson Soares <gsoares@cvs.openbsd.org> | 2011-10-29 12:18:15 +0000 |
| commit | e85bfc226d91432a22eb49fbde09eec6f4bf667d (patch) | |
| tree | f05a1f1284d64566871a325b6b4be4201194cdf7 | |
| parent | 11f1265ddce4159260addaea63051f2f257976c8 (diff) | |
avoid an out-of-bounds array access in urtwn_iq_calib_chain();
(this function is not yet called)
ok deraadt@
| -rw-r--r-- | sys/dev/usb/if_urtwn.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/usb/if_urtwn.c b/sys/dev/usb/if_urtwn.c index ebff3d82855..a4a2c9dd13d 100644 --- a/sys/dev/usb/if_urtwn.c +++ b/sys/dev/usb/if_urtwn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_urtwn.c,v 1.18 2011/07/03 15:47:17 matthew Exp $ */ +/* $OpenBSD: if_urtwn.c,v 1.19 2011/10/29 12:18:14 gsoares Exp $ */ /*- * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr> @@ -2890,9 +2890,9 @@ urtwn_iq_calib_chain(struct urtwn_softc *sc, int chain, uint16_t tx[2], if (status & (1 << (27 + chain * 3))) return (1); /* Rx failed. */ /* Read Rx IQ calibration results. */ - rx[2] = (urtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff; - rx[3] = (urtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff; - if (rx[2] == 0x132 || rx[3] == 0x036) + rx[0] = (urtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff; + rx[1] = (urtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff; + if (rx[0] == 0x132 || rx[1] == 0x036) return (1); /* Rx failed. */ return (3); /* Both Tx and Rx succeeded. */ |