From: John W. Linville Date: Mon, 17 Aug 2009 16:09:26 +0000 (-0400) Subject: orinoco: correct key bounds check in orinoco_hw_get_tkip_iv X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=518ff04fd84290a7ad9042e8a46d78d29cb443d3;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git orinoco: correct key bounds check in orinoco_hw_get_tkip_iv If key is 4 that is an array out of bounds. Reported-by: Dan Carpenter Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c index 632fac86a308..b3946272c72e 100644 --- a/drivers/net/wireless/orinoco/hw.c +++ b/drivers/net/wireless/orinoco/hw.c @@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc) int err = 0; u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE]; - if ((key < 0) || (key > 4)) + if ((key < 0) || (key >= 4)) return -EINVAL; err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,