diff --git a/[refs] b/[refs]
index 5beed259690b..7d9c3ff05329 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4535743304c7652f8e4a6dc35276d466fd97c0e3
+refs/heads/master: 6b7200fe0a59d7bda59e9e028b235b25a137dff9
diff --git a/trunk/drivers/staging/vt6655/wpactl.c b/trunk/drivers/staging/vt6655/wpactl.c
index a0f994ed58fe..732ba88dc796 100644
--- a/trunk/drivers/staging/vt6655/wpactl.c
+++ b/trunk/drivers/staging/vt6655/wpactl.c
@@ -213,7 +213,9 @@ int wpa_set_wpadev(PSDevice pDevice, int val)
 	int uu, ii;
 
 
-	if (param->u.wpa_key.alg_name > WPA_ALG_CCMP)
+	if (param->u.wpa_key.alg_name > WPA_ALG_CCMP ||
+			param->u.wpa_key.key_len >= MAX_KEY_LEN ||
+			param->u.wpa_key.seq_len >= MAX_KEY_LEN)
 		return -EINVAL;
 
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "param->u.wpa_key.alg_name = %d \n", param->u.wpa_key.alg_name);