Jump to the next element and not to an arbitrary point. frm[1] contains

the element's data length, frm[2] is the first byte of the element's data.

Submitted by:	Monthadar Al Jaberi <monthadar at gmail.com>
MFC after:	1 week
This commit is contained in:
Bernhard Schmidt 2011-01-19 17:40:58 +00:00
parent 98d1f19ba2
commit d3befdecdf

View file

@ -1463,7 +1463,7 @@ mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
meshid = frm;
break;
}
frm += frm[2] + 2;
frm += frm[1] + 2;
}
IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);