mac80211: check power constraint IE size when parsing

The power constraint IE is always a single byte
so check the size when parsing instead of later.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 471fb0516c9..ed7543960b1 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->country_elem_len = elen;
                         break;
                 case WLAN_EID_PWR_CONSTRAINT:
+                        if (elen != 1) {
+                                elem_parse_failed = true;
+                                break;
+                        }
                         elems->pwr_constr_elem = pos;
-                        elems->pwr_constr_elem_len = elen;
                         break;
                 case WLAN_EID_TIMEOUT_INTERVAL:
                         elems->timeout_int = pos;