if (!tkey->tx_phase1_done) { tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2, tkey->tx_iv32); tkey->tx_phase1_done = 1; } tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16); 
len = skb->len - hdr_len; pos = skb->data + hdr_len; 
static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv){	struct ieee80211_tkip_data *tkey = priv;	int len;	u8 rc4key[16], *pos, *icv;	struct ieee80211_hdr_4addr *hdr;	u32 crc;	struct scatterlist sg;	hdr = (struct ieee80211_hdr_4addr *)skb->data;	if (tkey->ieee->tkip_countermeasures) {		if (net_ratelimit()) {			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "			       "TX packet to " MAC_FMT "\n",			       tkey->ieee->dev->name, MAC_ARG(hdr->addr1));		}		return -1;	}	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 4 ||	    skb->len < hdr_len)		return -1;	if (!tkey->tx_phase1_done) {		tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,				   tkey->tx_iv32);		tkey->tx_phase1_done = 1;	}	tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);	len = skb->len - hdr_len;	pos = skb_push(skb, 8);	memmove(pos, pos + 8, hdr_len);	pos += hdr_len;	icv = skb_put(skb, 4);	*pos++ = rc4key[0];	*pos++ = rc4key[1];	*pos++ = rc4key[2];	*pos++ = (tkey->key_idx << 6) | (1 << 5) /* Ext IV included */ ;	*pos++ = tkey->tx_iv32 & 0xff;	*pos++ = (tkey->tx_iv32 >> 8) & 0xff;	*pos++ = (tkey->tx_iv32 >> 16) & 0xff;	*pos++ = (tkey->tx_iv32 >> 24) & 0xff;	crc = ~crc32_le(~0, pos, len);	icv[0] = crc;	icv[1] = crc >> 8;	icv[2] = crc >> 16;	icv[3] = crc >> 24;	crypto_cipher_setkey(tkey->tfm_arc4, rc4key, 16);	sg.page = virt_to_page(pos);	sg.offset = offset_in_page(pos);	sg.length = len + 4;	crypto_cipher_encrypt(tkey->tfm_arc4, &sg, &sg, len + 4);	tkey->tx_iv16++;	if (tkey->tx_iv16 == 0) {		tkey->tx_phase1_done = 0;		tkey->tx_iv32++;	}	return 0;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/31b59eaee8f8ec29d8cb6ac0c8eed086689d8030/ieee80211_crypt_tkip.c/buggy/net/ieee80211/ieee80211_crypt_tkip.c