mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-17 10:26:15 +00:00
Code Issues Releases Activity

correct ie length check; need to include fixed part of ie

Browse Source 
MFC after:	2 weeks
This commit is contained in:
Sam Leffler 2006-07-16 21:19:28 +00:00
parent d259662b81
commit 5eac3ff784
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=160413
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/net80211/ieee80211_input.c
View File

@ -1819,7 +1819,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
scan.chan = scan.bchan;
while (efrm - frm > 1) {
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
switch (*frm) {
case IEEE80211_ELEMID_SSID:
scan.ssid = frm;
@ -2066,7 +2066,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
*/
ssid = rates = xrates = NULL;
while (efrm - frm > 1) {
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
switch (*frm) {
case IEEE80211_ELEMID_SSID:
ssid = frm;
@ -2243,7 +2243,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
frm += 6; /* ignore current AP info */
ssid = rates = xrates = wpa = wme = NULL;
while (efrm - frm > 1) {
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
switch (*frm) {
case IEEE80211_ELEMID_SSID:
ssid = frm;
@ -2449,7 +2449,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
rates = xrates = wpa = wme = NULL;
while (efrm - frm > 1) {
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
switch (*frm) {
case IEEE80211_ELEMID_RATES:
rates = frm;