byKeyIndex is an unsigned char between 0 and 0xf. If it is any value higher than 1, then we will hit an integer wrap issue here.
Signed-off-by: Dan Carpenter <[email protected]> diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c index 3390838..a54c0c1 100644 --- a/drivers/staging/vt6656/rxtx.c +++ b/drivers/staging/vt6656/rxtx.c @@ -355,7 +355,7 @@ s_vFillTxKey ( } // Append IV after Mac Header *pdwIV &= WEP_IV_MASK;//00000000 11111111 11111111 11111111 - *pdwIV |= (pDevice->byKeyIndex << 30); + *pdwIV |= (unsigned long)pDevice->byKeyIndex << 30; *pdwIV = cpu_to_le32(*pdwIV); pDevice->dwIVCounter++; if (pDevice->dwIVCounter > WEP_IV_MASK) { diff --git a/drivers/staging/vt6655/rxtx.c b/drivers/staging/vt6655/rxtx.c index 4972e57..875ee44 100644 --- a/drivers/staging/vt6655/rxtx.c +++ b/drivers/staging/vt6655/rxtx.c @@ -242,7 +242,7 @@ s_vFillTxKey ( } // Append IV after Mac Header *pdwIV &= WEP_IV_MASK;//00000000 11111111 11111111 11111111 - *pdwIV |= (byKeyIndex << 30); + *pdwIV |= (unsigned long)byKeyIndex << 30; *pdwIV = cpu_to_le32(*pdwIV); pDevice->dwIVCounter++; if (pDevice->dwIVCounter > WEP_IV_MASK) { _______________________________________________ devel mailing list [email protected] http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
