2013-06-06 07:43:41

by Dan Carpenter

[permalink] [raw]
Subject: [patch] cw1200: read beyond end of array in debug code

This has only one caller and rates[] is an array with
IEEE80211_TX_MAX_RATES (4) elements.

Signed-off-by: Dan Carpenter <[email protected]>

diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index 0e40890..a254747 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -190,13 +190,12 @@ static void tx_policy_build(const struct cw1200_common *priv,
policy->retry_count += retries;
}

- pr_debug("[TX policy] Policy (%zu): %d:%d, %d:%d, %d:%d, %d:%d, %d:%d\n",
+ pr_debug("[TX policy] Policy (%zu): %d:%d, %d:%d, %d:%d, %d:%d\n",
count,
rates[0].idx, rates[0].count,
rates[1].idx, rates[1].count,
rates[2].idx, rates[2].count,
- rates[3].idx, rates[3].count,
- rates[4].idx, rates[4].count);
+ rates[3].idx, rates[3].count);
}

static inline bool tx_policy_is_equal(const struct tx_policy *wanted,