.. | .. |
---|
1086 | 1086 | { |
---|
1087 | 1087 | __le16 key_flags; |
---|
1088 | 1088 | struct iwl_addsta_cmd sta_cmd; |
---|
| 1089 | + size_t to_copy; |
---|
1089 | 1090 | int i; |
---|
1090 | 1091 | |
---|
1091 | 1092 | spin_lock_bh(&priv->sta_lock); |
---|
.. | .. |
---|
1105 | 1106 | sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32; |
---|
1106 | 1107 | for (i = 0; i < 5; i++) |
---|
1107 | 1108 | sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]); |
---|
1108 | | - memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen); |
---|
| 1109 | + /* keyconf may contain MIC rx/tx keys which iwl does not use */ |
---|
| 1110 | + to_copy = min_t(size_t, sizeof(sta_cmd.key.key), keyconf->keylen); |
---|
| 1111 | + memcpy(sta_cmd.key.key, keyconf->key, to_copy); |
---|
1109 | 1112 | break; |
---|
1110 | 1113 | case WLAN_CIPHER_SUITE_WEP104: |
---|
1111 | 1114 | key_flags |= STA_KEY_FLG_KEY_SIZE_MSK; |
---|