[Ipw2100-devel] [PATCH] ipw2x00: Write outside array bounds

[Roel K. <roe...@gm...>]

channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
incremented. This might be able to access 1 past the end of the array

Signed-off-by: Roel Kluin <roe...@gm...>
---
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3..d1c9d6d 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6249,7 +6249,10 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
 
 				channels[channel - 1] = 1;
 				priv->speed_scan_pos++;
-				channel_index++;
+
+				if (++channel_index >= IPW_SCAN_CHANNELS)
+					break;
+
 				scan->channels_list[channel_index] = channel;
 				index =
 				    ieee80211_channel_to_index(priv->ieee, channel);