Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 17 Mar 2012 06:48:14 +0000 (UTC)
From:      Mitsuru IWASAKI <iwasaki@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
Subject:   svn commit: r233077 - stable/9/sys/dev/iwi
Message-ID:  <201203170648.q2H6mE9V054789@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: iwasaki
Date: Sat Mar 17 06:48:13 2012
New Revision: 233077
URL: http://svn.freebsd.org/changeset/base/233077

Log:
  MFC r232785
  
  Fix wrong asresp frame parsing in iwi_checkforqos().

Modified:
  stable/9/sys/dev/iwi/if_iwi.c

Modified: stable/9/sys/dev/iwi/if_iwi.c
==============================================================================
--- stable/9/sys/dev/iwi/if_iwi.c	Sat Mar 17 05:45:21 2012	(r233076)
+++ stable/9/sys/dev/iwi/if_iwi.c	Sat Mar 17 06:48:13 2012	(r233077)
@@ -1357,8 +1357,8 @@ iwi_checkforqos(struct ieee80211vap *vap
 	frm += 2;
 
 	wme = NULL;
-	while (frm < efrm) {
-		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return);
+	while (efrm - frm > 1) {
+		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 		switch (*frm) {
 		case IEEE80211_ELEMID_VENDOR:
 			if (iswmeoui(frm))



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201203170648.q2H6mE9V054789>