From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 11 Oct 2012 06:55:25 +0000 (+0300)
Subject: Staging: vt6655-6: shift wrap in hostap_set_encryption()
X-Git-Tag: firefly_0821_release~3680^2~1519^2~1126
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=c25015c1184e7e54c02e0dfd5044eec38dec482c;p=firefly-linux-kernel-4.4.55.git

Staging: vt6655-6: shift wrap in hostap_set_encryption()

abySeq is an unsigned char so shifting more than 31 bits will lead to a
shift wrapping bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index 67b1b88b1b89..5f13890cf124 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -596,9 +596,9 @@ static int hostap_set_encryption(PSDevice pDevice,
 
 	if (param->u.crypt.seq) {
 	    memcpy(&abySeq, param->u.crypt.seq, 8);
-		for (ii = 0 ; ii < 8 ; ii++) {
-	         KeyRSC |= (abySeq[ii] << (ii * 8));
-		}
+		for (ii = 0 ; ii < 8 ; ii++)
+			KeyRSC |= (unsigned long)abySeq[ii] << (ii * 8);
+
 		dwKeyIndex |= 1 << 29;
 		pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC;
 	}
diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
index 0a73d4060ee1..26a7d0e4b048 100644
--- a/drivers/staging/vt6656/hostap.c
+++ b/drivers/staging/vt6656/hostap.c
@@ -542,9 +542,9 @@ static int hostap_set_encryption(PSDevice pDevice,
 
 	if (param->u.crypt.seq) {
 	    memcpy(&abySeq, param->u.crypt.seq, 8);
-		for (ii = 0 ; ii < 8 ; ii++) {
-	         KeyRSC |= (abySeq[ii] << (ii * 8));
-		}
+		for (ii = 0 ; ii < 8 ; ii++)
+			KeyRSC |= (unsigned long)abySeq[ii] << (ii * 8);
+
 		dwKeyIndex |= 1 << 29;
 		pMgmt->sNodeDBTable[iNodeIndex].KeyRSC = KeyRSC;
 	}