K 10
svn:author
V 5
markj
K 8
svn:date
V 27
2022-03-15T18:17:23.307018Z
K 7
svn:log
V 897
net80211: correct length check in ieee80211_ies_expand()

In ieee80211_ies_expand() we are looping over Elements
(also known as Information Elements or IEs).
The comment suggests that we assume well-formedness of
the IEs themselves.
Checking the buffer length being least 2 (1 byte Element ID and
1 byte Length fields) rather than just 1 before accessing ie[1]
is still good practise and can prevent and out-of-bounds read in
case the input is not behaving according to the comment.

Reported by:	(coypu sdf.org)
admbugs:	857
MFC after:	3 days
Reviewed by:	adrian, markj
Differential Revision: https://reviews.freebsd.org/D32340

(cherry picked from commit 09dd08f167812a5fdb516fc98f14dbb43221432f)
(cherry picked from commit 8dc4c0a922b7e7a0ee682f4e1426f876692c0828)

Approved by:	so
Security:	FreeBSD-SA-22:02.wifi

Git Hash:   a4c0d14bbc9bfe8e7dff3657d4b4bb1705d8668b
Git Author: bz@FreeBSD.org
END