diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2015-11-28 10:54:16 +0100 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2015-11-28 19:23:27 +0000 |
| commit | fef89fc4cf5da5df6e07af22adcb1b24ac41048b (patch) | |
| tree | 72ce4454910f37e0ee6b690b48b242d573f14652 | |
| parent | 644bc7868dda0717f7e49ec01e07e0043f7385fb (diff) | |
| download | wireshark-fef89fc4cf5da5df6e07af22adcb1b24ac41048b.tar.gz | |
vwr: fix buffer overrun in getRate
Bug: 11789
Change-Id: Ieba9f32928b91be5d07b25bf54005155f7cc79f6
Reviewed-on: https://code.wireshark.org/review/12261
Reviewed-by: Michael Mann <mmann78@netscape.net>
(cherry picked from commit 135c8f050f7f0145b54d952b38ca73eb0d1060cf)
Reviewed-on: https://code.wireshark.org/review/12262
| -rw-r--r-- | wiretap/vwr.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/wiretap/vwr.c b/wiretap/vwr.c index 7fc36d647b..c1bc5bd8ae 100644 --- a/wiretap/vwr.c +++ b/wiretap/vwr.c @@ -2112,7 +2112,10 @@ static float getRate( guint8 plcpType, guint8 mcsIndex, guint16 rflags, guint8 n float symbol_tx_time, bitrate = 0.0f; if (plcpType == 0) - bitrate = canonical_rate_legacy[mcsIndex]; + { + if (mcsIndex < G_N_ELEMENTS(canonical_rate_legacy)) + bitrate = canonical_rate_legacy[mcsIndex]; + } else if (plcpType == 1 || plcpType == 2) { if ( rflags & FLAGS_CHAN_SHORTGI) @@ -2134,8 +2137,8 @@ static float getRate( guint8 plcpType, guint8 mcsIndex, guint16 rflags, guint8 n else symbol_tx_time = 4.0f; - /* Check for the out of range mcsIndex. Should never happen, but if mcs index is greater than 9 assume 9 is the value */ - if (mcsIndex > 9) mcsIndex = 9; + /* Check for the out of range mcsIndex. Should never happen, but if mcs index is greater than 9 assume 9 is the value */ + if (mcsIndex > 9) mcsIndex = 9; if ( rflags & FLAGS_CHAN_40MHZ ) bitrate = (canonical_ndbps_40_vht[ mcsIndex ] * nss) / symbol_tx_time; else if (rflags & FLAGS_CHAN_80MHZ ) |