iw: fix pointer arithmetic in __print_he_capa

Found by fuzzing with clang fuzzer.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20210213114853.17276-1-markus.theil@tu-ilmenau.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/util.c b/util.c
index 12ba2181c69bb2d1e2b4a16d700f918021e287c0..9f21f5fba18e9342093b14aac7fa9fb79f95f238 100644 (file)
--- a/util.c
+++ b/util.c
@@ -1160,7 +1160,7 @@ static void __print_he_capa(const __u16 *mac_cap,
 
        /* Caller didn't provide ppet; infer it, if there's trailing space. */
        if (!ppet) {
-               ppet = (const void *)(mcs_set + mcs_used);
+               ppet = (const void *)((const __u8 *)mcs_set + mcs_used);
                if (mcs_used < mcs_len)
                        ppet_len = mcs_len - mcs_used;
                else