CVSROOT: /cvs Module name: src Changes by: mes...@cvs.openbsd.org 2017/08/22 02:49:23
Modified files:
sys/dev/ic : ar5xxx.c
Log message:
Fix off by one overwrite. Covery CID 1452938.
ee->ee_ctls evaluates to either 16 or 32 depending on the card's EEPROM version
and with the current loop condition it will write out of bounds in the second
ee->ee_ctls assignment once the condition is either i < 16 or i < 32.
OK stsp@ and tb@
