From 7f2907fd70cf0ce99e8e1c3c97289777c27604b9 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@FreeBSD.org>
Date: Sun, 29 Sep 2002 18:40:35 +0000
Subject: [PATCH] Limit the TX key to a valid range

PR: 39960, 39961 (patches here pointed out problem, but didn't quite fix it)
---
 sys/dev/wi/if_wi.c    | 6 ++++++
 sys/dev/wi/if_wivar.h | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c
index 1c00a6bf6f16..9fdc0c52690c 100644
--- a/sys/dev/wi/if_wi.c
+++ b/sys/dev/wi/if_wi.c
@@ -1268,6 +1268,8 @@ wi_write_record(sc, ltv)
 			ltv = &p2ltv;
 			break;
 		case WI_RID_TX_CRYPT_KEY:
+			if (ltv->wi_val > WI_NLTV_KEYS)
+				return (EINVAL);
 			p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
 			p2ltv.wi_len = 2;
 			p2ltv.wi_val = ltv->wi_val;
@@ -1328,6 +1330,10 @@ wi_write_record(sc, ltv)
 			case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
 			default: return EINVAL;
 			}
+		case WI_RID_TX_CRYPT_KEY:
+			if (ltv->wi_val > WI_NLTV_KEYS)
+				return (EINVAL);
+			break;
 		}
 	}
 
diff --git a/sys/dev/wi/if_wivar.h b/sys/dev/wi/if_wivar.h
index e615e0b125f7..92d908dca719 100644
--- a/sys/dev/wi/if_wivar.h
+++ b/sys/dev/wi/if_wivar.h
@@ -85,10 +85,11 @@ struct wi_key {
 	u_int8_t		wi_keydat[14];
 };
 
+#define WI_NLTV_KEYS 4
 struct wi_ltv_keys {
 	u_int16_t		wi_len;
 	u_int16_t		wi_type;
-	struct wi_key		wi_keys[4];
+	struct wi_key		wi_keys[WI_NLTV_KEYS];
 };
 
 struct wi_softc	{