madwifi: fix an array overrun in the rate control attach check

[openwrt/svn-archive/archive.git] / package / madwifi / patches / 105-ratectl_attach.patch

diff --git a/package/madwifi/patches/105-ratectl_attach.patch b/package/madwifi/patches/105-ratectl_attach.patch
index edce19a96874d262a770cddcb56b655ae965c020..80aad835e7a6f60cc2367917824842575aff2684 100644 (file)
--- a/package/madwifi/patches/105-ratectl_attach.patch
+++ b/package/madwifi/patches/105-ratectl_attach.patch
@@ -1,8 +1,6 @@
-Index: madwifi-ng-r2799-20071030/net80211/ieee80211_rate.c
-===================================================================
---- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_rate.c   2007-10-31 14:04:46.861291953 +0100
-+++ madwifi-ng-r2799-20071030/net80211/ieee80211_rate.c        2007-10-31 14:04:48.109363075 +0100
-@@ -100,8 +100,18 @@
+--- a/net80211/ieee80211_rate.c
++++ b/net80211/ieee80211_rate.c
+@@ -100,8 +100,18 @@ struct ath_ratectrl *ieee80211_rate_atta
                ieee80211_load_module(buf);
  
        if (!ratectls[id].attach) {
@@ -10,7 +8,7 @@ Index: madwifi-ng-r2799-20071030/net80211/ieee80211_rate.c
 -              return NULL;
 +              /* pick the first available rate control module */
 +              printk(KERN_INFO "Rate control module \"%s\" not available\n", buf);
-+              for (id = 0; id < IEEE80211_RATE_MAX; id++) {
++              for (id = 0; id < IEEE80211_RATE_MAX - 1; id++) {
 +                      if (ratectls[id].attach)
 +                              break;
 +              }