1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-20 11:11:24 +00:00

Jump to the next element and not to an arbitrary point. frm[1] contains

the element's data length, frm[2] is the first byte of the element's data.

Submitted by:	Monthadar Al Jaberi <monthadar at gmail.com>
MFC after:	1 week
This commit is contained in:
Bernhard Schmidt 2011-01-19 17:40:58 +00:00
parent 98d1f19ba2
commit d3befdecdf
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=217590

View File

@ -1463,7 +1463,7 @@ mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
meshid = frm;
break;
}
frm += frm[2] + 2;
frm += frm[1] + 2;
}
IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);