From: Jouni Malinen <j@w1.fi>
Date: Thu, 11 Mar 2010 22:41:03 +0000 (+0200)
Subject: nl80211: Fix FT Action send command
X-Git-Tag: hostap_0_7_2~142
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=73fc617d5c1df9e70c50ff78e1ea84f377c972a7;p=thirdparty%2Fhostap.git

nl80211: Fix FT Action send command

Need to include payload header in the data length to avoid sending
truncated FT Action frame.
---

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index d4679b96f..575976021 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -5126,8 +5126,8 @@ static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
 	 * FT IEs
 	 */
 
-	data_len = ies_len;
-	data = os_malloc(2 + 2 * ETH_ALEN + data_len);
+	data_len = 2 + 2 * ETH_ALEN + ies_len;
+	data = os_malloc(data_len);
 	if (data == NULL)
 		return -1;
 	pos = data;