projects / platform / kernel / kernel-mfld-blackbay.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 523d2f6)
orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
authorJohn W. Linville <linville@tuxdriver.com>
Mon, 17 Aug 2009 16:09:26 +0000 (12:09 -0400)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 17 Aug 2009 17:38:34 +0000 (13:38 -0400)
If key is 4 that is an array out of bounds.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/orinoco/hw.c patch | blob | history

diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac8..b394627 100644 (file)
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
        int err = 0;
        u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
 
-       if ((key < 0) || (key > 4))
+       if ((key < 0) || (key >= 4))
                return -EINVAL;
 
        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
Domain: System / Uncategorized;