Commit ff4573a7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: vt6655-6: shift wrap buf in s_vFillTxKey() 



byKeyIndex is an unsigned char between 0 and 0xf.  If it is any value
higher than 1, then we will hit an integer wrap issue here.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f20fbdf8

drivers/staging/vt6655/rxtx.c

+1 −1
Original line number Diff line number Diff line
@@ -242,7 +242,7 @@ s_vFillTxKey ( 
        }

        // Append IV after Mac Header

        *pdwIV &= WEP_IV_MASK;//00000000 11111111 11111111 11111111

        *pdwIV |= (byKeyIndex << 30);

        *pdwIV |= (unsigned long)byKeyIndex << 30;

        *pdwIV = cpu_to_le32(*pdwIV);

        pDevice->dwIVCounter++;

        if (pDevice->dwIVCounter > WEP_IV_MASK) {

drivers/staging/vt6656/rxtx.c

+1 −1
Original line number Diff line number Diff line
@@ -355,7 +355,7 @@ s_vFillTxKey ( 
        }

        // Append IV after Mac Header

        *pdwIV &= WEP_IV_MASK;//00000000 11111111 11111111 11111111

        *pdwIV |= (pDevice->byKeyIndex << 30);

        *pdwIV |= (unsigned long)pDevice->byKeyIndex << 30;

        *pdwIV = cpu_to_le32(*pdwIV);

        pDevice->dwIVCounter++;

        if (pDevice->dwIVCounter > WEP_IV_MASK) {