commit f4b64c603e1f3764c4ffa42b3b7c74c8fa284542
author Jouni Malinen <j@w1.fi> Sun Apr 19 17:03:23 2015 +0300
committer Jouni Malinen <j@w1.fi> Wed Apr 22 22:05:12 2015 +0300
tree 3e65fec71fe7e86400a2af7f174c0766e13ba348
parent d6fefd64d2b42285029b6f620a9ca0a3172abe92

Simplify VHT Operation element parsing

Check the element length in the parser and remove the length field from
struct ieee802_11_elems since the element is of fixed length.

Signed-off-by: Jouni Malinen <j@w1.fi>

src/common/ieee802_11_common.c

diff --git a/src/common/ieee802_11_common.c b/src/common/ieee802_11_common.c
index 85d6ca8..7843e6f 100644
--- a/src/common/ieee802_11_common.c
+++ b/src/common/ieee802_11_common.c
@@ -292,8 +292,9 @@
 			elems->vht_capabilities = pos;
 			break;
 		case WLAN_EID_VHT_OPERATION:
+			if (elen < sizeof(struct ieee80211_vht_operation))
+				break;
 			elems->vht_operation = pos;
-			elems->vht_operation_len = elen;
 			break;
 		case WLAN_EID_VHT_OPERATING_MODE_NOTIFICATION:
 			if (elen != 1)

src/common/ieee802_11_common.h

diff --git a/src/common/ieee802_11_common.h b/src/common/ieee802_11_common.h
index 33e60b2..c84d8a7 100644
--- a/src/common/ieee802_11_common.h
+++ b/src/common/ieee802_11_common.h
@@ -64,7 +64,6 @@
 	u8 mesh_config_len;
 	u8 mesh_id_len;
 	u8 peer_mgmt_len;
-	u8 vht_operation_len;
 	u8 vendor_ht_cap_len;
 	u8 vendor_vht_len;
 	u8 p2p_len;