summaryrefslogtreecommitdiff
path: root/net/mac80211/util.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2013-03-27 14:31:53 +0100
committerJohannes Berg <johannes.berg@intel.com>2013-04-08 09:16:57 +0200
commit1946bed95707ef75d85e94ebe106ce7a119ca831 (patch)
treea0be226b4fed65ac75344222e70c2cdddb5b0888 /net/mac80211/util.c
parent1cd8e88e17729f57a9c7f751103e522596bb5de2 (diff)
mac80211: check ERP info IE length in parser
It's always just one byte, so check for that and remove the length field from the parser struct. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/util.c')
-rw-r--r--net/mac80211/util.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0f7d1c20f8ac..4839dec5c9ac 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -780,8 +780,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
elems->rsn_len = elen;
break;
case WLAN_EID_ERP_INFO:
- elems->erp_info = pos;
- elems->erp_info_len = elen;
+ if (elen >= 1)
+ elems->erp_info = pos;
+ else
+ elem_parse_failed = true;
break;
case WLAN_EID_EXT_SUPP_RATES:
elems->ext_supp_rates = pos;