HT: Fix 20/40 coex Action frame parsing

Commit 5ce3ae4c8f2a07c28e0bbae1b68e5524ee034387 tried to clean up
fetching a pointer to the action code field, but it forgot to add
IEEE80211_HDRLEN to the pointer. This resulted in the coex report
elements being read from too early in the frame.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/ieee802_11_ht.c b/src/ap/ieee802_11_ht.c
index fe878839f97b9d403c44e5399e7c221ce2b3eec4..f549421784c1dd6e9f58992fb3c580804795a73d 100644 (file)
--- a/src/ap/ieee802_11_ht.c
+++ b/src/ap/ieee802_11_ht.c
@@ -211,7 +211,7 @@ void hostapd_2040_coex_action(struct hostapd_data *hapd,
        struct ieee80211_2040_intol_chan_report *ic_report;
        int is_ht_allowed = 1;
        int i;
-       const u8 *data = ((const u8 *) mgmt) + 1;
+       const u8 *data = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
 
        hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
                       HOSTAPD_LEVEL_DEBUG, "hostapd_public_action - action=%d",