From 55f2eefaa743ae0d482f876d6ba1d2266ab30d29 Mon Sep 17 00:00:00 2001
From: bschmidt <bschmidt@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Wed, 26 Jan 2011 16:59:07 +0000
Subject: [PATCH] MFC r217590: Jump to the next element and not to an arbitrary
 point. frm[1] contains the element's data length, frm[2] is the first byte of
 the element's data.

Submitted by:	Monthadar Al Jaberi <monthadar at gmail.com>


git-svn-id: svn://svn.freebsd.org/base/stable/8@217885 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 sys/net80211/ieee80211_mesh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/net80211/ieee80211_mesh.c b/sys/net80211/ieee80211_mesh.c
index d42d55db7..852077ee8 100644
--- a/sys/net80211/ieee80211_mesh.c
+++ b/sys/net80211/ieee80211_mesh.c
@@ -1461,7 +1461,7 @@ mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
 				meshid = frm;
 				break;
 			}
-			frm += frm[2] + 2;
+			frm += frm[1] + 2;
 		}
 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
-- 
2.45.0