diff options
-rw-r--r-- | include/net/ieee80211.h | 5 | ||||
-rw-r--r-- | net/ieee80211/ieee80211_rx.c | 10 |
2 files changed, 5 insertions, 10 deletions
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h index 6394ae4bf17d..27374c27c408 100644 --- a/include/net/ieee80211.h +++ b/include/net/ieee80211.h | |||
@@ -505,11 +505,6 @@ enum ieee80211_mfie { | |||
505 | MFIE_TYPE_GENERIC = 221, | 505 | MFIE_TYPE_GENERIC = 221, |
506 | }; | 506 | }; |
507 | 507 | ||
508 | struct ieee80211_info_element_hdr { | ||
509 | u8 id; | ||
510 | u8 len; | ||
511 | } __attribute__ ((packed)); | ||
512 | |||
513 | struct ieee80211_info_element { | 508 | struct ieee80211_info_element { |
514 | u8 id; | 509 | u8 id; |
515 | u8 len; | 510 | u8 len; |
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c index cae55e5ccb2e..e0337c8fcde8 100644 --- a/net/ieee80211/ieee80211_rx.c +++ b/net/ieee80211/ieee80211_rx.c | |||
@@ -823,10 +823,10 @@ static inline int ieee80211_network_init(struct ieee80211_device *ieee, struct i | |||
823 | network->rsn_ie_len = 0; | 823 | network->rsn_ie_len = 0; |
824 | 824 | ||
825 | info_element = beacon->info_element; | 825 | info_element = beacon->info_element; |
826 | left = stats->len - ((void *)info_element - (void *)beacon); | 826 | left = stats->len - sizeof(*beacon); |
827 | while (left >= sizeof(struct ieee80211_info_element_hdr)) { | 827 | while (left >= sizeof(struct ieee80211_info_element)) { |
828 | if (sizeof(struct ieee80211_info_element_hdr) + | 828 | if (sizeof(struct ieee80211_info_element) + info_element->len > |
829 | info_element->len > left) { | 829 | left) { |
830 | IEEE80211_DEBUG_SCAN | 830 | IEEE80211_DEBUG_SCAN |
831 | ("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%Zd left=%d.\n", | 831 | ("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%Zd left=%d.\n", |
832 | info_element->len + | 832 | info_element->len + |
@@ -967,7 +967,7 @@ static inline int ieee80211_network_init(struct ieee80211_device *ieee, struct i | |||
967 | break; | 967 | break; |
968 | } | 968 | } |
969 | 969 | ||
970 | left -= sizeof(struct ieee80211_info_element_hdr) + | 970 | left -= sizeof(struct ieee80211_info_element) + |
971 | info_element->len; | 971 | info_element->len; |
972 | info_element = (struct ieee80211_info_element *) | 972 | info_element = (struct ieee80211_info_element *) |
973 | &info_element->data[info_element->len]; | 973 | &info_element->data[info_element->len]; |