- Tighten invariant on loops used to parse ie's; this ensures we never
commit8c56084fba69def7b2aae15bb2e5508fa3ac26c0
authorSepherosa Ziehau <sephe@dragonflybsd.org>
Tue, 21 Nov 2006 12:07:21 +0000 (21 12:07 +0000)
committerSepherosa Ziehau <sephe@dragonflybsd.org>
Tue, 21 Nov 2006 12:07:21 +0000 (21 12:07 +0000)
tree16a6d372f3fd6be0d7ecf9189229df17b8fcada4
parent54d017fd90981de61697475d7db081784fa2b690
- Tighten invariant on loops used to parse ie's; this ensures we never
  touch data outside the packet (previously we might touch 1 byte); it
  also has the happy side effect of working around broken orinoco/agere
  firmware that sends malformed association response frames
- Correct ie length check; need to include fixed part of ie

Obtained-from: FreeBSD (sam@freebsd.org)
sys/netproto/802_11/wlan/ieee80211_input.c