Roel Kluin 57921c312e libertas: Read buffer overflow ... Several arrays were read before checking whether the index was within bounds. ARRAY_SIZE() should be used to determine the size of arrays. rates->rates has an arraysize of 1, so calling get_common_rates() with a rates_size of MAX_RATES (14) was causing reads out of bounds. tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1), so that should be the number of elements of tmp[]. A goto can be eliminated: ret was already set upon its declaration. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2009-07-29 14:52:01 -04:00
..
ath	ath9k: Read outside array bounds	2009-07-27 15:19:36 -04:00
b43	b43: Add support for 4318E	2009-07-08 15:24:24 -04:00
b43legacy	b43/b43legacy: fix radio LED initialization	2009-07-07 12:55:26 -04:00
hostap	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6	2009-06-15 03:02:23 -07:00
ipw2x00	net: use symbolic values for ndo_start_xmit() return codes	2009-06-13 01:18:50 -07:00
iwlwifi	iwlwifi: Read outside array bounds	2009-07-27 15:19:37 -04:00
iwmc3200wifi	wireless: ERR_PTR vs null	2009-07-27 15:19:35 -04:00
libertas	libertas: Read buffer overflow	2009-07-29 14:52:01 -04:00
libertas_tf
orinoco	netdev: restore MAC address set and validate operations	2009-07-12 14:20:02 -07:00
p54	p54spi: fix potential null deref in p54spi.c	2009-07-21 15:59:48 -04:00
prism54	net: fix network drivers ndo_start_xmit() return values (part 3)	2009-06-13 01:18:37 -07:00
rt2x00	rt2x00: Fix chipset detection for rt2500usb	2009-07-21 12:07:43 -04:00
rtl818x	rtl8187: Fix for kernel oops when unloading with LEDs enabled	2009-07-21 12:07:42 -04:00
wl12xx
zd1211rw	zd1211rw: adding SONY IFU-WLM2 (054c:0257) as a zd1211b device	2009-07-08 15:24:23 -04:00
adm8211.c
adm8211.h
airo_cs.c
airo.c	airo: Buffer overflow	2009-07-27 15:19:36 -04:00
airo.h
arlan-main.c	net: use symbolic values for ndo_start_xmit() return codes	2009-06-13 01:18:50 -07:00
arlan-proc.c
arlan.h
at76c50x-usb.c
at76c50x-usb.h
atmel_cs.c
atmel_pci.c
atmel.c	net: use symbolic values for ndo_start_xmit() return codes	2009-06-13 01:18:50 -07:00
atmel.h
i82586.h
i82593.h
Kconfig	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6	2009-06-15 03:02:23 -07:00
mac80211_hwsim.c	mac80211_hwsim: fix use after free	2009-07-21 12:07:40 -04:00
Makefile
mwl8k.c
netwave_cs.c
ray_cs.c	net: use symbolic values for ndo_start_xmit() return codes	2009-06-13 01:18:50 -07:00
ray_cs.h
rayctl.h
rndis_wlan.c	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6	2009-06-15 03:02:23 -07:00
strip.c	Revert "NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines."	2009-07-14 13:13:41 -07:00
wavelan_cs.c	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6	2009-06-15 03:02:23 -07:00
wavelan_cs.h
wavelan_cs.p.h
wavelan.c	net: use symbolic values for ndo_start_xmit() return codes	2009-06-13 01:18:50 -07:00
wavelan.h
wavelan.p.h
wl3501_cs.c	net: fix network drivers ndo_start_xmit() return values (part 3)	2009-06-13 01:18:37 -07:00
wl3501.h
zd1201.c	net: fix network drivers ndo_start_xmit() return values (part 3)	2009-06-13 01:18:37 -07:00
zd1201.h