2007-10-14 17:51:53

by Adrian Bunk

Subject: [2.6 patch] iwl4965-base.c: fix off-by-one errors

This patch fixes two off-by-one errors resulting in array overflows
spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <[email protected]>

---

drivers/net/wireless/iwlwifi/iwl4965-base.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

--- linux-2.6/drivers/net/wireless/iwlwifi/iwl4965-base.c.old 2007-10-14 16:52:21.000000000 +0200
+++ linux-2.6/drivers/net/wireless/iwlwifi/iwl4965-base.c 2007-10-14 16:59:37.000000000 +0200
@@ -4489,23 +4489,23 @@ static u8 ratio2dB[100] = {
39, 39, 39, 39, 39, 40, 40, 40, 40, 40 /* 90 - 99 */
};

/* Calculates a relative dB value from a ratio of linear
* (i.e. not dB) signal levels.
* Conversion assumes that levels are voltages (20*log), not powers (10*log). */
int iwl_calc_db_from_ratio(int sig_ratio)
{
- /* Anything above 1000:1 just report as 60 dB */
- if (sig_ratio > 1000)
+ /* 1000:1 or higher just report as 60 dB */
+ if (sig_ratio >= 1000)
return 60;

- /* Above 100:1, divide by 10 and use table,
+ /* 100:1 or higher, divide by 10 and use table,
* add 20 dB to make up for divide by 10 */
- if (sig_ratio > 100)
+ if (sig_ratio >= 100)
return (20 + (int)ratio2dB[sig_ratio/10]);

/* We shouldn't see this */
if (sig_ratio < 1)
return 0;

/* Use table for ratios 1:1 - 99:1 */
return (int)ratio2dB[sig_ratio];

2007-10-17 07:41:55

by Zhu Yi

Subject: Re: [2.6 patch] iwl4965-base.c: fix off-by-one errors

On Sun, 2007-10-14 at 19:51 +0200, Adrian Bunk wrote:
> This patch fixes two off-by-one errors resulting in array overflows
> spotted by the Coverity checker.
>
> Signed-off-by: Adrian Bunk <[email protected]>

ACK.

John, please apply.

Thanks,
-yi

2007-10-18 14:40:12

by Cahill, Ben M

Subject: RE: [2.6 patch] iwl4965-base.c: fix off-by-one errors

ACK ... good catch.

-- Ben --

> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Adrian Bunk
> Sent: Sunday, October 14, 2007 1:51 PM
> To: Zhu, Yi
> Cc: [email protected];
> [email protected]; [email protected]
> Subject: [2.6 patch] iwl4965-base.c: fix off-by-one errors
>
> This patch fixes two off-by-one errors resulting in array
> overflows spotted by the Coverity checker.
>
> Signed-off-by: Adrian Bunk <[email protected]>
>
> ---
>
> drivers/net/wireless/iwlwifi/iwl4965-base.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> --- linux-2.6/drivers/net/wireless/iwlwifi/iwl4965-base.c.old
> 2007-10-14 16:52:21.000000000 +0200
> +++ linux-2.6/drivers/net/wireless/iwlwifi/iwl4965-base.c
> 2007-10-14 16:59:37.000000000 +0200
> @@ -4489,23 +4489,23 @@ static u8 ratio2dB[100] = {
> 39, 39, 39, 39, 39, 40, 40, 40, 40, 40 /* 90 - 99 */ };
>
> /* Calculates a relative dB value from a ratio of linear
> * (i.e. not dB) signal levels.
> * Conversion assumes that levels are voltages (20*log), not
> powers (10*log). */ int iwl_calc_db_from_ratio(int sig_ratio) {
> - /* Anything above 1000:1 just report as 60 dB */
> - if (sig_ratio > 1000)
> + /* 1000:1 or higher just report as 60 dB */
> + if (sig_ratio >= 1000)
> return 60;
>
> - /* Above 100:1, divide by 10 and use table,
> + /* 100:1 or higher, divide by 10 and use table,
> * add 20 dB to make up for divide by 10 */
> - if (sig_ratio > 100)
> + if (sig_ratio >= 100)
> return (20 + (int)ratio2dB[sig_ratio/10]);
>
> /* We shouldn't see this */
> if (sig_ratio < 1)
> return 0;
>
> /* Use table for ratios 1:1 - 99:1 */
> return (int)ratio2dB[sig_ratio];
>
> -
> To unsubscribe from this list: send the line "unsubscribe
> linux-wireless" in the body of a message to
> [email protected] More majordomo info at
> http://vger.kernel.org/majordomo-info.html
>