sys/net80211/ieee80211_hostap.c

995     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
1035 	if (frm + 1 < efrm) {
1036 		if ((frm[1] + 2) > (efrm - frm)) {
1040 			    frm[0], (frm[1] + 2) - (efrm - frm));
1045 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
1046 			challenge = frm;
1047 		frm += frm[1] + 2;
1250 ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm,
1253 	uint8_t len = frm[1];
1274 	frm += 6, len -= 4;		/* NB: len is payload only */
1276 	w = le16dec(frm);
1283 	frm += 2, len -= 2;
1288 	error = wpa_cipher(frm, &rsn->rsn_mcastkeylen, &rsn->rsn_mcastcipher);
1293 		    le32dec(frm));
1296 	frm += 4, len -= 4;
1299 	n = le16dec(frm);
1300 	frm += 2, len -= 2;
1312 		error = wpa_cipher(frm, &rsn->rsn_ucastkeylen, &cipher);
1316 		frm += 4, len -= 4;
1332 	n = le16dec(frm);
1333 	frm += 2, len -= 2;
1343 		w |= wpa_keymgmt(frm);
1344 		frm += 4, len -= 4;
1352 		rsn->rsn_caps = le16dec(frm);
1427 ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
1430 	uint8_t len = frm[1];
1452 	frm += 2;
1453 	w = le16dec(frm);
1460 	frm += 2, len -= 2;
1465 	error = rsn_cipher(frm, &rsn->rsn_mcastkeylen, &rsn->rsn_mcastcipher);
1470 		    le32dec(frm));
1480 	frm += 4, len -= 4;
1483 	n = le16dec(frm);
1484 	frm += 2, len -= 2;
1497 		error = rsn_cipher(frm, &rsn->rsn_ucastkeylen, &cipher);
1501 		frm += 4, len -= 4;
1522 	n = le16dec(frm);
1523 	frm += 2, len -= 2;
1533 		w |= rsn_keymgmt(frm);
1534 		frm += 4, len -= 4;
1543 		rsn->rsn_caps = le16dec(frm);
1765 	uint8_t *frm, *efrm, *sfrm;
1772 	frm = (uint8_t *)&wh[1];
1901 		while (efrm - frm > 1) {
1902 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1903 			switch (*frm) {
1905 				ssid = frm;
1908 				rates = frm;
1911 				xrates = frm;
1914 			frm += frm[1] + 2;
1963 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1964 		algo   = le16toh(*(uint16_t *)frm);
1965 		seq    = le16toh(*(uint16_t *)(frm + 2));
1966 		status = le16toh(*(uint16_t *)(frm + 4));
1992 			hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
2062 		IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
2063 		capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
2064 		lintval = le16toh(*(uint16_t *)frm);	frm += 2;
2066 			frm += 6;	/* ignore current AP info */
2069 		sfrm = frm;
2070 		while (efrm - frm > 1) {
2071 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2072 			switch (*frm) {
2074 				ssid = frm;
2077 				rates = frm;
2080 				xrates = frm;
2083 				rsn = frm;
2086 				htcap = frm;
2089 				vhtcap = frm;
2092 				vhtinfo = frm;
2095 				if (iswpaoui(frm))
2096 					wpa = frm;
2097 				else if (iswmeinfo(frm))
2098 					wme = frm;
2100 				else if (isatherosoui(frm))
2101 					ath = frm;
2104 					if (ishtcapoui(frm) && htcap == NULL)
2105 						htcap = frm;
2109 			frm += frm[1] + 2;
2326 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2328 		reason = le16toh(*(uint16_t *)frm);
2364 				(void)ic->ic_recv_action(ni, wh, frm, efrm);