From c25015c1184e7e54c02e0dfd5044eec38dec482c Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 11 Oct 2012 09:55:25 +0300 Subject: [PATCH] Staging: vt6655-6: shift wrap in hostap_set_encryption() abySeq is an unsigned char so shifting more than 31 bits will lead to a shift wrapping bug. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/staging/vt6655/hostap.c | 6 +++--- drivers/staging/vt6656/hostap.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c index 67b1b88..5f13890 100644 --- a/drivers/staging/vt6655/hostap.c +++ b/drivers/staging/vt6655/hostap.c @@ -596,9 +596,9 @@ static int hostap_set_encryption(PSDevice pDevice, if (param->u.crypt.seq) { memcpy(&abySeq, param->u.crypt.seq, 8); - for (ii = 0 ; ii < 8 ; ii++) { - KeyRSC |= (abySeq[ii] << (ii * 8)); - } + for (ii = 0 ; ii < 8 ; ii++) + KeyRSC |= (unsigned long)abySeq[ii] << (ii * 8); + dwKeyIndex |= 1 << 29; pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC; } diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c index 0a73d40..26a7d0e 100644 --- a/drivers/staging/vt6656/hostap.c +++ b/drivers/staging/vt6656/hostap.c @@ -542,9 +542,9 @@ static int hostap_set_encryption(PSDevice pDevice, if (param->u.crypt.seq) { memcpy(&abySeq, param->u.crypt.seq, 8); - for (ii = 0 ; ii < 8 ; ii++) { - KeyRSC |= (abySeq[ii] << (ii * 8)); - } + for (ii = 0 ; ii < 8 ; ii++) + KeyRSC |= (unsigned long)abySeq[ii] << (ii * 8); + dwKeyIndex |= 1 << 29; pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC; } -- 2.7.4