2008-02-02 21:18:16

by Adrian Bunk

Subject: [2.6 patch] iwl3945-base.c: fix off-by-one errors

This patch fixes two off-by-one errors resulting in array overflows
spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <[email protected]>

---

I remember having fixed exactly the same bug in iwl4965-base.c some time
ago - it might perhaps be possible to share some of the duplicated code
between the two drivers?


--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -4207,13 +4207,13 @@ static u8 ratio2dB[100] = {
* Conversion assumes that levels are voltages (20*log), not powers (10*log). */
int iwl3945_calc_db_from_ratio(int sig_ratio)
{
- /* Anything above 1000:1 just report as 60 dB */
- if (sig_ratio > 1000)
+ /* 1000:1 or higher just report as 60 dB */
+ if (sig_ratio >= 1000)
return 60;

- /* Above 100:1, divide by 10 and use table,
+ /* 100:1 or higher, divide by 10 and use table,
* add 20 dB to make up for divide by 10 */
- if (sig_ratio > 100)
+ if (sig_ratio >= 100)
return (20 + (int)ratio2dB[sig_ratio/10]);

/* We shouldn't see this */

2008-02-02 22:24:52

by Tomas Winkler

Subject: Re: [2.6 patch] iwl3945-base.c: fix off-by-one errors

On Feb 2, 2008 11:19 PM, Adrian Bunk <[email protected]> wrote:
> This patch fixes two off-by-one errors resulting in array overflows
> spotted by the Coverity checker.
>
> Signed-off-by: Adrian Bunk <[email protected]>
>
> ---
>
> I remember having fixed exactly the same bug in iwl4965-base.c some time
> ago - it might perhaps be possible to share some of the duplicated code
> between the two drivers?

We are working on it.

>
> --- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
> +++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
> @@ -4207,13 +4207,13 @@ static u8 ratio2dB[100] = {
> * Conversion assumes that levels are voltages (20*log), not powers (10*log). */
> int iwl3945_calc_db_from_ratio(int sig_ratio)
> {
> - /* Anything above 1000:1 just report as 60 dB */
> - if (sig_ratio > 1000)
> + /* 1000:1 or higher just report as 60 dB */
> + if (sig_ratio >= 1000)
> return 60;
>
> - /* Above 100:1, divide by 10 and use table,
> + /* 100:1 or higher, divide by 10 and use table,
> * add 20 dB to make up for divide by 10 */
> - if (sig_ratio > 100)
> + if (sig_ratio >= 100)
> return (20 + (int)ratio2dB[sig_ratio/10]);
>
> /* We shouldn't see this */
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
ACK

Thanks
Tomas