Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

[linux-2.6-block.git] / drivers / net / wireless / marvell / mwifiex / scan.c

diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index d870d4b2e03da203f094617b316a8930fd44d235..0d6d41727037a737ed224ca84b6bd370dc0a5b7b 100644 (file)
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1361,21 +1361,25 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
                        break;
 
                case WLAN_EID_VENDOR_SPECIFIC:
-                       if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
-                               return -EINVAL;
-
                        vendor_ie = (struct ieee_types_vendor_specific *)
                                        current_ptr;
 
-                       if (!memcmp
-                           (vendor_ie->vend_hdr.oui, wpa_oui,
-                            sizeof(wpa_oui))) {
+                       /* 802.11 requires at least 3-byte OUI. */
+                       if (element_len < sizeof(vendor_ie->vend_hdr.oui.oui))
+                               return -EINVAL;
+
+                       /* Not long enough for a match? Skip it. */
+                       if (element_len < sizeof(wpa_oui))
+                               break;
+
+                       if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
+                                   sizeof(wpa_oui))) {
                                bss_entry->bcn_wpa_ie =
                                        (struct ieee_types_vendor_specific *)
                                        current_ptr;
                                bss_entry->wpa_offset = (u16)
                                        (current_ptr - bss_entry->beacon_buf);
-                       } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
+                       } else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
                                    sizeof(wmm_oui))) {
                                if (total_ie_len ==
                                    sizeof(struct ieee_types_wmm_parameter) ||