From b14b54982c72969ec5ff287ff2eb44258dadc724 Mon Sep 17 00:00:00 2001
From: avos <avos@FreeBSD.org>
Date: Wed, 12 Apr 2017 07:21:54 +0000
Subject: [PATCH] rtwn: remove out-of-bounds access + fix debug output.

Omit unused rates while initializing / dumping Tx power values.

They were not accessed anywhere (except for debugging), so this is
(mostly) no-op.

Tested with
 * RTL8188EU, STA mode.
 * RTL8812AU, STA mode.

Found by:	PVS-Studio
---
 sys/dev/rtwn/rtl8188e/r88e_chan.c | 2 +-
 sys/dev/rtwn/rtl8192c/r92c_chan.c | 8 ++++----
 sys/dev/rtwn/rtl8812a/r12a_chan.c | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/sys/dev/rtwn/rtl8188e/r88e_chan.c b/sys/dev/rtwn/rtl8188e/r88e_chan.c
index 94d5445f258d..018c2734262c 100644
--- a/sys/dev/rtwn/rtl8188e/r88e_chan.c
+++ b/sys/dev/rtwn/rtl8188e/r88e_chan.c
@@ -110,7 +110,7 @@ r88e_get_txpower(struct rtwn_softc *sc, int chain,
 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
 			power[ridx] = base->pwr[0][ridx];
 	}
-	for (ridx = RTWN_RIDX_OFDM6; ridx < RTWN_RIDX_COUNT; ridx++) {
+	for (ridx = RTWN_RIDX_OFDM6; ridx <= max_mcs; ridx++) {
 		if (rs->regulatory == 3)
 			power[ridx] = base->pwr[0][ridx];
 		else if (rs->regulatory == 1) {
diff --git a/sys/dev/rtwn/rtl8192c/r92c_chan.c b/sys/dev/rtwn/rtl8192c/r92c_chan.c
index 59443faf205f..4126194cfa91 100644
--- a/sys/dev/rtwn/rtl8192c/r92c_chan.c
+++ b/sys/dev/rtwn/rtl8192c/r92c_chan.c
@@ -229,13 +229,13 @@ r92c_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c)
 		rtwn_r92c_get_txpower(sc, i, c, power);
 #ifdef RTWN_DEBUG
 		if (sc->sc_debug & RTWN_DEBUG_TXPWR) {
-			int ridx;
+			int max_mcs, ridx;
+
+			max_mcs = RTWN_RIDX_MCS(sc->ntxchains * 8 - 1);
 
 			/* Dump per-rate Tx power values. */
 			printf("Tx power for chain %d:\n", i);
-			for (ridx = RTWN_RIDX_CCK1;
-			     ridx < RTWN_RIDX_COUNT;
-			     ridx++)
+			for (ridx = RTWN_RIDX_CCK1; ridx <= max_mcs; ridx++)
 				printf("Rate %d = %u\n", ridx, power[ridx]);
 		}
 #endif
diff --git a/sys/dev/rtwn/rtl8812a/r12a_chan.c b/sys/dev/rtwn/rtl8812a/r12a_chan.c
index 25ab394ff466..c68bef0c1e92 100644
--- a/sys/dev/rtwn/rtl8812a/r12a_chan.c
+++ b/sys/dev/rtwn/rtl8812a/r12a_chan.c
@@ -247,7 +247,7 @@ r12a_get_txpower(struct rtwn_softc *sc, int chain,
 	if (sc->sc_debug & RTWN_DEBUG_TXPWR) {
 		/* Dump per-rate Tx power values. */
 		printf("Tx power for chain %d:\n", chain);
-		for (ridx = RTWN_RIDX_CCK1; ridx < RTWN_RIDX_COUNT; ridx++)
+		for (ridx = RTWN_RIDX_CCK1; ridx <= max_mcs; ridx++)
 			printf("Rate %d = %u\n", ridx, power[ridx]);
 	}
 #endif