[PATCH] libertas: Read buffer overflow

[Holger Schurig]

> -	size_t num_card_rates = sizeof(lbs_bg_rates);
> +	size_t num_card_rates = ARRAY_SIZE(lbs_bg_rates);

Hmm, not sure about this.  First I don't know if we need a 
variable for this at all. Can't you simply use ARRAY_SIZE() 
whenever it's needed?

If you want to keep num_card_rates, you should change it's 
type. "size_t" is normally used to denote sizes in bytes, e.g. 
it's the type for the length of malloc and friends. But now the 
variable holds a number of elements and should be int or 
unsigned int.

-- 
http://www.holgerschurig.de