diff options
| author |   Johannes Berg <johannes.berg@intel.com> | 2013-03-27 14:38:07 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-04-08 09:16:58 +0200 |
| commit | 79ba1d8910f517c3bd39d794ddb1a5b4c03795c4 (patch) | |
| tree | faff88285c710cacce1c04beda8074b57b17801a /net/mac80211/util.c | |
| parent | mac80211: check ERP info IE length in parser (diff) | |
| download | linux-dev-79ba1d8910f517c3bd39d794ddb1a5b4c03795c4.tar.xz linux-dev-79ba1d8910f517c3bd39d794ddb1a5b4c03795c4.zip | |
mac80211: parse Timeout Interval Element using a struct
Instead of open-coding the accesses and length check do
the length check in the IE parser and assign a struct
pointer for use in the remaining code.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/util.c')
| -rw-r--r-- | net/mac80211/util.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 4839dec5c9ac..f9581c6378ae 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -874,8 +874,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, elems->pwr_constr_elem = pos; break; case WLAN_EID_TIMEOUT_INTERVAL: - elems->timeout_int = pos; - elems->timeout_int_len = elen; + if (elen >= sizeof(struct ieee80211_timeout_interval_ie)) + elems->timeout_int = (void *)pos; + else + elem_parse_failed = true; break; default: break; |