diff options
Diffstat (limited to 'drivers/staging/rtl8192e/rtllib_crypt_wep.c')
-rw-r--r-- | drivers/staging/rtl8192e/rtllib_crypt_wep.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/staging/rtl8192e/rtllib_crypt_wep.c b/drivers/staging/rtl8192e/rtllib_crypt_wep.c index b0e5f1f..85145ce 100644 --- a/drivers/staging/rtl8192e/rtllib_crypt_wep.c +++ b/drivers/staging/rtl8192e/rtllib_crypt_wep.c @@ -105,6 +105,7 @@ static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv) u32 crc; u8 *icv; struct scatterlist sg; + if (skb_headroom(skb) < 4 || skb_tailroom(skb) < 4 || skb->len < hdr_len){ printk(KERN_ERR "Error!!! headroom=%d tailroom=%d skblen=%d" @@ -126,6 +127,7 @@ static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv) * can be used to speedup attacks, so avoid using them. */ if ((wep->iv & 0xff00) == 0xff00) { u8 B = (wep->iv >> 16) & 0xff; + if (B >= 3 && B < klen) wep->iv += 0x0100; } @@ -177,6 +179,7 @@ static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv) u32 crc; u8 icv[4]; struct scatterlist sg; + if (skb->len < hdr_len + 8) return -1; @@ -250,6 +253,7 @@ static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv) static void prism2_wep_print_stats(struct seq_file *m, void *priv) { struct prism2_wep_data *wep = priv; + seq_printf(m, "key[%d] alg=WEP len=%d\n", wep->key_idx, wep->key_len); } |