Commit c25015c1 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

Staging: vt6655-6: shift wrap in hostap_set_encryption()

abySeq is an unsigned char so shifting more than 31 bits will lead to a
shift wrapping bug.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ff4573a7
...@@ -596,9 +596,9 @@ static int hostap_set_encryption(PSDevice pDevice, ...@@ -596,9 +596,9 @@ static int hostap_set_encryption(PSDevice pDevice,
if (param->u.crypt.seq) { if (param->u.crypt.seq) {
memcpy(&abySeq, param->u.crypt.seq, 8); memcpy(&abySeq, param->u.crypt.seq, 8);
for (ii = 0 ; ii < 8 ; ii++) { for (ii = 0 ; ii < 8 ; ii++)
KeyRSC |= (abySeq[ii] << (ii * 8)); KeyRSC |= (unsigned long)abySeq[ii] << (ii * 8);
}
dwKeyIndex |= 1 << 29; dwKeyIndex |= 1 << 29;
pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC; pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC;
} }
......
...@@ -542,9 +542,9 @@ static int hostap_set_encryption(PSDevice pDevice, ...@@ -542,9 +542,9 @@ static int hostap_set_encryption(PSDevice pDevice,
if (param->u.crypt.seq) { if (param->u.crypt.seq) {
memcpy(&abySeq, param->u.crypt.seq, 8); memcpy(&abySeq, param->u.crypt.seq, 8);
for (ii = 0 ; ii < 8 ; ii++) { for (ii = 0 ; ii < 8 ; ii++)
KeyRSC |= (abySeq[ii] << (ii * 8)); KeyRSC |= (unsigned long)abySeq[ii] << (ii * 8);
}
dwKeyIndex |= 1 << 29; dwKeyIndex |= 1 << 29;
pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC; pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment