qca/open-ath9k-htc-firmware — pull request #55 by biergaizi (2014-05-23 15:56:59+00:00)
Title: Fix Array Out of Bounds in rcSibUpdate_ht()

In rcSibUpdate_ht(), we clear
validPhyRateIndex[WLAN_RC_PHY_MAX][MAX_TX_RATE_PHY]
by a for loop.

But, validPhyRateIndex was defined with
validPhyRateIndex[WLAN_RC_PHY_MAX][MAX_TX_RATE_TBL],
and MAX_TX_RATE_TBL is always greater than MAX_TX_RATE_PHY,
caused the out of bounds array access.

This commit corrects MAX_TX_RATE_PHY to MAX_TX_RATE_TBL,
and remove MAX_TX_RATE_PHY from ratectrl.h because it is
no longer be used.

Signed-off-by: Tom Li