Date: Sat, 17 Mar 2012 06:49:53 +0000 (UTC) From: Mitsuru IWASAKI <iwasaki@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org Subject: svn commit: r233078 - stable/8/sys/dev/iwi Message-ID: <201203170649.q2H6nr6S054879@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: iwasaki Date: Sat Mar 17 06:49:53 2012 New Revision: 233078 URL: http://svn.freebsd.org/changeset/base/233078 Log: MFC r232785 Fix wrong asresp frame parsing in iwi_checkforqos(). Modified: stable/8/sys/dev/iwi/if_iwi.c Modified: stable/8/sys/dev/iwi/if_iwi.c ============================================================================== --- stable/8/sys/dev/iwi/if_iwi.c Sat Mar 17 06:48:13 2012 (r233077) +++ stable/8/sys/dev/iwi/if_iwi.c Sat Mar 17 06:49:53 2012 (r233078) @@ -1355,8 +1355,8 @@ iwi_checkforqos(struct ieee80211vap *vap frm += 2; wme = NULL; - while (frm < efrm) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return); + while (efrm - frm > 1) { + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return); switch (*frm) { case IEEE80211_ELEMID_VENDOR: if (iswmeoui(frm))
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201203170649.q2H6nr6S054879>