svn commit: r217885 - stable/8/sys/net80211

[Bernhard Schmidt]

Author: bschmidt
Date: Wed Jan 26 16:59:07 2011
New Revision: 217885
URL: http://svn.freebsd.org/changeset/base/217885

Log:
  MFC r217590:
  Jump to the next element and not to an arbitrary point. frm[1] contains
  the element's data length, frm[2] is the first byte of the element's data.
  
  Submitted by:	Monthadar Al Jaberi <monthadar at gmail.com>

Modified:
  stable/8/sys/net80211/ieee80211_mesh.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/net80211/ieee80211_mesh.c
==============================================================================
--- stable/8/sys/net80211/ieee80211_mesh.c	Wed Jan 26 13:18:26 2011	(r217884)
+++ stable/8/sys/net80211/ieee80211_mesh.c	Wed Jan 26 16:59:07 2011	(r217885)
@@ -1461,7 +1461,7 @@ mesh_recv_mgmt(struct ieee80211_node *ni
 				meshid = frm;
 				break;
 			}
-			frm += frm[2] + 2;
+			frm += frm[1] + 2;
 		}
 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);