diff options
Diffstat (limited to 'net/ieee80211/ieee80211_rx.c')
-rw-r--r-- | net/ieee80211/ieee80211_rx.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c index cae55e5ccb2e..e0337c8fcde8 100644 --- a/net/ieee80211/ieee80211_rx.c +++ b/net/ieee80211/ieee80211_rx.c | |||
@@ -823,10 +823,10 @@ static inline int ieee80211_network_init(struct ieee80211_device *ieee, struct i | |||
823 | network->rsn_ie_len = 0; | 823 | network->rsn_ie_len = 0; |
824 | 824 | ||
825 | info_element = beacon->info_element; | 825 | info_element = beacon->info_element; |
826 | left = stats->len - ((void *)info_element - (void *)beacon); | 826 | left = stats->len - sizeof(*beacon); |
827 | while (left >= sizeof(struct ieee80211_info_element_hdr)) { | 827 | while (left >= sizeof(struct ieee80211_info_element)) { |
828 | if (sizeof(struct ieee80211_info_element_hdr) + | 828 | if (sizeof(struct ieee80211_info_element) + info_element->len > |
829 | info_element->len > left) { | 829 | left) { |
830 | IEEE80211_DEBUG_SCAN | 830 | IEEE80211_DEBUG_SCAN |
831 | ("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%Zd left=%d.\n", | 831 | ("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%Zd left=%d.\n", |
832 | info_element->len + | 832 | info_element->len + |
@@ -967,7 +967,7 @@ static inline int ieee80211_network_init(struct ieee80211_device *ieee, struct i | |||
967 | break; | 967 | break; |
968 | } | 968 | } |
969 | 969 | ||
970 | left -= sizeof(struct ieee80211_info_element_hdr) + | 970 | left -= sizeof(struct ieee80211_info_element) + |
971 | info_element->len; | 971 | info_element->len; |
972 | info_element = (struct ieee80211_info_element *) | 972 | info_element = (struct ieee80211_info_element *) |
973 | &info_element->data[info_element->len]; | 973 | &info_element->data[info_element->len]; |