orinoco: correct key bounds check in orinoco_hw_get_tkip_iv

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

If key is 4 that is an array out of bounds.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

John W. Linville 16 years ago 518ff04f 523d2f69

+1 -1

1 changed file

expand all

drivers

net

wireless

orinoco

hw.c

+1 -1

drivers/net/wireless/orinoco/hw.c

··· 70 70 int err = 0; 71 71 u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE]; 72 72 73 - if ((key < 0) || (key > 4)) 73 + if ((key < 0) || (key >= 4)) 74 74 return -EINVAL; 75 75 76 76 err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,