diff options
| author | sam <sam@FreeBSD.org> | 2006-07-16 21:19:28 +0000 |
|---|---|---|
| committer | sam <sam@FreeBSD.org> | 2006-07-16 21:19:28 +0000 |
| commit | c088f3a6cca6e4dad7d490d016bc0678f508ecd0 (patch) | |
| tree | 11df73a50e14d40dbdabfb79288da123c16ff64e /sys/net80211/ieee80211_input.c | |
| parent | ae11c9115b9964fa0099ab8194b82e764a27ba43 (diff) | |
| download | FreeBSD-src-c088f3a6cca6e4dad7d490d016bc0678f508ecd0.zip FreeBSD-src-c088f3a6cca6e4dad7d490d016bc0678f508ecd0.tar.gz | |
correct ie length check; need to include fixed part of ie
MFC after: 2 weeks
Diffstat (limited to 'sys/net80211/ieee80211_input.c')
| -rw-r--r-- | sys/net80211/ieee80211_input.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c index c1c5d97..f278b73 100644 --- a/sys/net80211/ieee80211_input.c +++ b/sys/net80211/ieee80211_input.c @@ -1819,7 +1819,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, scan.chan = scan.bchan; while (efrm - frm > 1) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); switch (*frm) { case IEEE80211_ELEMID_SSID: scan.ssid = frm; @@ -2066,7 +2066,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, */ ssid = rates = xrates = NULL; while (efrm - frm > 1) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); switch (*frm) { case IEEE80211_ELEMID_SSID: ssid = frm; @@ -2243,7 +2243,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, frm += 6; /* ignore current AP info */ ssid = rates = xrates = wpa = wme = NULL; while (efrm - frm > 1) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); switch (*frm) { case IEEE80211_ELEMID_SSID: ssid = frm; @@ -2449,7 +2449,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, rates = xrates = wpa = wme = NULL; while (efrm - frm > 1) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); switch (*frm) { case IEEE80211_ELEMID_RATES: rates = frm; |
