WNM: Use cleaner way of generating pointer to a field (CID 68099)

The Action code field is in a fixed location, so the IEEE80211_HDRLEN
can be used here to clean up bounds checking to avoid false reports from
static analyzer.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 8e5bdcb068ac614928de056ae8bc07b4156d42e1..cf25dbb688c754ba76064e11635473f40cf352ad 100644 (file)
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -376,10 +376,9 @@ int ieee802_11_rx_wnm_action_ap(struct hostapd_data *hapd,
        if (len < IEEE80211_HDRLEN + 2)
                return -1;
 
-       payload = &mgmt->u.action.category;
-       payload++;
+       payload = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
        action = *payload++;
-       plen = (((const u8 *) mgmt) + len) - payload;
+       plen = len - IEEE80211_HDRLEN - 2;
 
        switch (action) {
        case WNM_BSS_TRANS_MGMT_QUERY: