From 698963ba7e15feee49cf47ac2181cf143e7af99b Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Thu, 6 Dec 2012 17:03:17 +0100 Subject: [PATCH] regulatory: don't write past array when intersecting rules When intersecting rules, we count first to know how many rules need to be allocated, and then do the intersection into the allocated array. However, the code doing this writes past the end of the array because it attempts to do all intersections. Make it stop when the right number of rules has been reached. Acked-by: Luis R. Rodriguez Signed-off-by: Johannes Berg --- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 6e5308998e307..40646e823d5d7 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -647,9 +647,9 @@ static struct ieee80211_regdomain *regdom_intersect( if (!rd) return NULL; - for (x = 0; x < rd1->n_reg_rules; x++) { + for (x = 0; x < rd1->n_reg_rules && rule_idx < num_rules; x++) { rule1 = &rd1->reg_rules[x]; - for (y = 0; y < rd2->n_reg_rules; y++) { + for (y = 0; y < rd2->n_reg_rules && rule_idx < num_rules; y++) { rule2 = &rd2->reg_rules[y]; /* * This time around instead of using the stack lets -- 2.39.5