summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/orinoco
diff options
context:
space:
mode:
authorJohn W. Linville <linville@tuxdriver.com>2009-08-17 18:09:26 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-08-17 19:38:34 +0200
commit518ff04fd84290a7ad9042e8a46d78d29cb443d3 (patch)
treec9557455099ced436ae0c24e5b1b8dbd3cc24fcf /drivers/net/wireless/orinoco
parentmac80211: fix todo lock (diff)
downloadlinux-518ff04fd84290a7ad9042e8a46d78d29cb443d3.tar.xz
linux-518ff04fd84290a7ad9042e8a46d78d29cb443d3.zip
orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
If key is 4 that is an array out of bounds. Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/orinoco')
-rw-r--r--drivers/net/wireless/orinoco/hw.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac86a308..b3946272c72e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
int err = 0;
u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
- if ((key < 0) || (key > 4))
+ if ((key < 0) || (key >= 4))
return -EINVAL;
err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,