On Fri, 2018-08-31 at 11:31 +0300, Luca Coelho wrote: > > + cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); > + if (cap && cap[1] >= sizeof(*params->he_cap) + 1) > + params->he_cap = (void *)(cap + 3); I think this should validate that the element is actually well-formed before passing it to the driver. To do this, need to refactor the size checks from ieee80211_he_cap_ie_to_sta_he_cap(). johannes
