From fa74829ac6af01ea4fd7dae2b0f94c38b2aa9eb4 Mon Sep 17 00:00:00 2001 From: Anjan Chanda <anjan.chanda@iopsys.eu> Date: Tue, 21 Mar 2023 20:20:36 +0100 Subject: [PATCH] libwifi: pass correct length of IE-EXT in wifi_cap_set_from_ie() --- libwifi/modules/broadcom/wlctrl.c | 2 +- libwifi/wifiutils.c | 5 +---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/libwifi/modules/broadcom/wlctrl.c b/libwifi/modules/broadcom/wlctrl.c index f7b05643..55532953 100644 --- a/libwifi/modules/broadcom/wlctrl.c +++ b/libwifi/modules/broadcom/wlctrl.c @@ -2131,7 +2131,7 @@ int bcmwl_iface_ap_info(const char *name, struct wifi_ap *ap) if (ie_ptr) { ap->bss.caps.valid |= WIFI_CAP_HE_VALID; memcpy(&ap->bss.caps.he, &ie_ptr[3], min(ie_ptr[1], sizeof(struct wifi_caps_he))); - wifi_cap_set_from_ie(ap->bss.cbitmap, ie_ptr, ie_ptr[1] + 3); + wifi_cap_set_from_ie(ap->bss.cbitmap, ie_ptr, ie_ptr[1] + 2); } /* WMM stats */ diff --git a/libwifi/wifiutils.c b/libwifi/wifiutils.c index 33cd48cf..6033e8f2 100644 --- a/libwifi/wifiutils.c +++ b/libwifi/wifiutils.c @@ -545,10 +545,7 @@ void wifi_cap_set_from_ie(uint8_t *bitmap, uint8_t *ie, size_t len) return; } - if (ie[0] != IE_EXT && ie[1] != len - 2) - return; /* bad request */ - - if (ie[0] == IE_EXT && ie[1] != len - 3) + if (ie[1] != len - 2) return; /* bad request */ eid = ie[0]; -- GitLab