From d3befdecdf5302237ce3cde51d8a2a1fd4fca2c4 Mon Sep 17 00:00:00 2001
From: Bernhard Schmidt <bschmidt@FreeBSD.org>
Date: Wed, 19 Jan 2011 17:40:58 +0000
Subject: [PATCH] Jump to the next element and not to an arbitrary point.
 frm[1] contains the element's data length, frm[2] is the first byte of the
 element's data.

Submitted by:	Monthadar Al Jaberi <monthadar at gmail.com>
MFC after:	1 week
---
 sys/net80211/ieee80211_mesh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/net80211/ieee80211_mesh.c b/sys/net80211/ieee80211_mesh.c
index 1086113f0a4..028fc14ffd4 100644
--- a/sys/net80211/ieee80211_mesh.c
+++ b/sys/net80211/ieee80211_mesh.c
@@ -1463,7 +1463,7 @@ mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
 				meshid = frm;
 				break;
 			}
-			frm += frm[2] + 2;
+			frm += frm[1] + 2;
 		}
 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);