2 files changed, 8 insertions, 1 deletions
diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c
index 1c00a6b..9fdc0c5 100644
--- a/sys/dev/wi/if_wi.c
+++ b/sys/dev/wi/if_wi.c
@@ -1268,6 +1268,8 @@ wi_write_record(sc, ltv)
 			ltv = &p2ltv;
 			break;
 		case WI_RID_TX_CRYPT_KEY:
+			if (ltv->wi_val > WI_NLTV_KEYS)
+				return (EINVAL);
 			p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
 			p2ltv.wi_len = 2;
 			p2ltv.wi_val = ltv->wi_val;
@@ -1328,6 +1330,10 @@ wi_write_record(sc, ltv)
 			case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
 			default: return EINVAL;
 			}
+		case WI_RID_TX_CRYPT_KEY:
+			if (ltv->wi_val > WI_NLTV_KEYS)
+				return (EINVAL);
+			break;
 		}
 	}
 
diff --git a/sys/dev/wi/if_wivar.h b/sys/dev/wi/if_wivar.h
index e615e0b..92d908d 100644
--- a/sys/dev/wi/if_wivar.h
+++ b/sys/dev/wi/if_wivar.h
@@ -85,10 +85,11 @@ struct wi_key {
 	u_int8_t		wi_keydat[14];
 };
 
+#define WI_NLTV_KEYS 4
 struct wi_ltv_keys {
 	u_int16_t		wi_len;
 	u_int16_t		wi_type;
-	struct wi_key		wi_keys[4];
+	struct wi_key		wi_keys[WI_NLTV_KEYS];
 };
 
 struct wi_softc	{