|
@@ -3074,8 +3074,9 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen,
|
|
|
* copied to new ie, skip ssid, capability, bssid-index ie
|
|
|
*/
|
|
|
tmp_new = sub_copy;
|
|
|
- while (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <=
|
|
|
- (subie_len - 1)) {
|
|
|
+ while ((subie_len > 0) &&
|
|
|
+ (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <=
|
|
|
+ (subie_len - 1))) {
|
|
|
if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP ||
|
|
|
tmp_new[0] == WLAN_ELEMID_SSID ||
|
|
|
tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX ||
|