From 18b931dde7d9259968a91a1baee96db92a79d34d Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@felloff.net>
Date: Fri, 30 Jan 2015 02:00:07 +0100
Subject: wifi: ignore truncated tlv in beacon/probes

---
 sys/src/9/pc/wifi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/src/9/pc/wifi.c b/sys/src/9/pc/wifi.c
index 62c0b9b76..19c5b3676 100644
--- a/sys/src/9/pc/wifi.c
+++ b/sys/src/9/pc/wifi.c
@@ -388,6 +388,8 @@ recvbeacon(Wifi *wifi, Wnode *wn, uchar *d, int len)
 	for(e = d + len; d+2 <= e; d = x){
 		d += 2;
 		x = d + d[-1];
+		if(x > e)
+			break;	/* truncated */
 		t = d[-2];
 
 		/* skip double entries */
-- 
cgit v1.2.3