diff options
| author | John W. Linville <linville@tuxdriver.com> | 2009-08-17 12:09:26 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-17 13:38:34 -0400 |
| commit | 518ff04fd84290a7ad9042e8a46d78d29cb443d3 (patch) | |
| tree | c9557455099ced436ae0c24e5b1b8dbd3cc24fcf /drivers/net/wireless/orinoco/hw.c | |
| parent | 523d2f6982136d332c9b7dd00e9e16da1091f060 (diff) | |
orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
If key is 4 that is an array out of bounds.
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/orinoco/hw.c')
| -rw-r--r-- | drivers/net/wireless/orinoco/hw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c index 632fac86a308..b3946272c72e 100644 --- a/drivers/net/wireless/orinoco/hw.c +++ b/drivers/net/wireless/orinoco/hw.c | |||
| @@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc) | |||
| 70 | int err = 0; | 70 | int err = 0; |
| 71 | u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE]; | 71 | u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE]; |
| 72 | 72 | ||
| 73 | if ((key < 0) || (key > 4)) | 73 | if ((key < 0) || (key >= 4)) |
| 74 | return -EINVAL; | 74 | return -EINVAL; |
| 75 | 75 | ||
| 76 | err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV, | 76 | err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV, |