libertas: Read buffer overflow

Check whether index is within bounds before testing the element.

(also includes "Libertas: Association request to the driver failed"

The size of the tmp buffer was too small, causing a regression

rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.

In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

0 files changed, 0 insertions, 0 deletions