Dan Carpenter <[email protected]> wrote: > The "rate_index" is only used as an index into the phist_data->rx_rate[] > array in the mwifiex_hist_data_set() function. That array has > MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some > debugfs information. The "rate_index" variable comes from the network > skb->data[] and it is a u8 so it's in the 0-255 range. We need to cap > it to prevent an array overflow. > > Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support") > Signed-off-by: Dan Carpenter <[email protected]>
Patch applied to wireless-drivers-next.git, thanks. b4c35c17227f mwifiex: prevent an array overflow -- https://patchwork.kernel.org/patch/10885297/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
