diff options
| author | John W. Linville <linville@tuxdriver.com> | 2009-08-17 12:09:26 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-17 13:38:34 -0400 |
| commit | 518ff04fd84290a7ad9042e8a46d78d29cb443d3 (patch) | |
| tree | c9557455099ced436ae0c24e5b1b8dbd3cc24fcf | |
| parent | 523d2f6982136d332c9b7dd00e9e16da1091f060 (diff) | |
orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
If key is 4 that is an array out of bounds.
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/orinoco/hw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c index 632fac86a30..b3946272c72 100644 --- a/drivers/net/wireless/orinoco/hw.c +++ b/drivers/net/wireless/orinoco/hw.c @@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc) int err = 0; u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE]; - if ((key < 0) || (key > 4)) + if ((key < 0) || (key >= 4)) return -EINVAL; err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV, |