iwlwifi: check scan request ie_len

In mac80211 we always check both scan_req->ie and scan_req->ie_len
against zero before usage, in iwlwifi we should do the same.

Remove not needed "left -= ie_len" while at it.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index d817c9c184a532cc0a7fb27ae88f2c4303721d1b..83e62917e0bf5293562fefd2696492bc64bc3302 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -644,10 +644,10 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
        if (WARN_ON(left < ie_len))
                return len;
 
-       if (ies)
+       if (ies && ie_len) {
                memcpy(pos, ies, ie_len);
-       len += ie_len;
-       left -= ie_len;
+               len += ie_len;
+       }
 
        return (u16)len;
 }