diff options
| author | Jouni Malinen <jouni@qca.qualcomm.com> | 2011-11-02 23:45:55 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2011-11-11 12:59:59 +0200 |
| commit | f4bb9a6fbc1f49058fc9eb6dcb4a3022d99013b4 (patch) | |
| tree | 45deb6e360d87d793f77701aec84fc0f8aa6515d /drivers/net/wireless/ath/ath6kl/wmi.c | |
| parent | 1ddc3377e1f43b0bd62c7042cb2032824ebfb663 (diff) | |
ath6kl: Fix key configuration to copy at most seq_len from seq
There is no guarantee on the caller using 8-octet buffer for
key->seq, so better follow the key->seq_len parameter on figuring
out how many octets to copy.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath6kl/wmi.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/wmi.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c index ece67a5c37b..612326d9607 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c @@ -2000,7 +2000,8 @@ int ath6kl_wmi_disctimeout_cmd(struct wmi *wmi, u8 if_idx, u8 timeout) int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index, enum crypto_type key_type, u8 key_usage, u8 key_len, - u8 *key_rsc, u8 *key_material, + u8 *key_rsc, unsigned int key_rsc_len, + u8 *key_material, u8 key_op_ctrl, u8 *mac_addr, enum wmi_sync_flag sync_flag) { @@ -2013,7 +2014,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index, key_index, key_type, key_usage, key_len, key_op_ctrl); if ((key_index > WMI_MAX_KEY_INDEX) || (key_len > WMI_MAX_KEY_LEN) || - (key_material == NULL)) + (key_material == NULL) || key_rsc_len > 8) return -EINVAL; if ((WEP_CRYPT != key_type) && (NULL == key_rsc)) @@ -2031,7 +2032,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index, memcpy(cmd->key, key_material, key_len); if (key_rsc != NULL) - memcpy(cmd->key_rsc, key_rsc, sizeof(cmd->key_rsc)); + memcpy(cmd->key_rsc, key_rsc, key_rsc_len); cmd->key_op_ctrl = key_op_ctrl; |