Date: Sat, 17 Mar 2012 06:48:14 +0000 (UTC) From: Mitsuru IWASAKI <iwasaki@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r233077 - stable/9/sys/dev/iwi Message-ID: <201203170648.q2H6mE9V054789@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: iwasaki Date: Sat Mar 17 06:48:13 2012 New Revision: 233077 URL: http://svn.freebsd.org/changeset/base/233077 Log: MFC r232785 Fix wrong asresp frame parsing in iwi_checkforqos(). Modified: stable/9/sys/dev/iwi/if_iwi.c Modified: stable/9/sys/dev/iwi/if_iwi.c ============================================================================== --- stable/9/sys/dev/iwi/if_iwi.c Sat Mar 17 05:45:21 2012 (r233076) +++ stable/9/sys/dev/iwi/if_iwi.c Sat Mar 17 06:48:13 2012 (r233077) @@ -1357,8 +1357,8 @@ iwi_checkforqos(struct ieee80211vap *vap frm += 2; wme = NULL; - while (frm < efrm) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return); + while (efrm - frm > 1) { + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return); switch (*frm) { case IEEE80211_ELEMID_VENDOR: if (iswmeoui(frm))
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201203170648.q2H6mE9V054789>