aboutsummaryrefslogtreecommitdiff
path: root/drivers/net/wireless
diff options
context:
space:
mode:
authorJohn W. Linville <linville@tuxdriver.com>2009-08-17 12:09:26 -0400
committerJohn W. Linville <linville@tuxdriver.com>2009-08-17 13:38:34 -0400
commit518ff04fd84290a7ad9042e8a46d78d29cb443d3 (patch)
treec9557455099ced436ae0c24e5b1b8dbd3cc24fcf /drivers/net/wireless
parent523d2f6982136d332c9b7dd00e9e16da1091f060 (diff)
orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
If key is 4 that is an array out of bounds. Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless')
-rw-r--r--drivers/net/wireless/orinoco/hw.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac86a30..b3946272c72 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
int err = 0;
u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
- if ((key < 0) || (key > 4))
+ if ((key < 0) || (key >= 4))
return -EINVAL;
err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,