orinoco: correct key bounds check in orinoco_hw_get_tkip_iv



If key is 4 that is an array out of bounds.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 523d2f69

drivers/net/wireless/orinoco/hw.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private priv, int key, u8 tsc)
		int err = 0;
		u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];

		if ((key < 0) \|\| (key > 4))
		if ((key < 0) \|\| (key >= 4))
		return -EINVAL;

		err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,