From e93df6407450aa46c06a08aa147ef76810d0f6d6 Mon Sep 17 00:00:00 2001
From: tb <tb@openbsd.org>
Date: Sun, 4 Jun 2017 12:48:42 +0000
Subject: [PATCH] Add sizes for free for the RSN IEs. Rewrite
 ieee80211_save_ie() slightly to make it more readable.

help, many explanations and ok stsp
---
 sys/net80211/ieee80211_input.c | 13 ++++++++-----
 sys/net80211/ieee80211_node.c  |  4 ++--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c
index 2b349bd95fb..ec7fcef9650 100644
--- a/sys/net80211/ieee80211_input.c
+++ b/sys/net80211/ieee80211_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_input.c,v 1.193 2017/06/03 15:44:03 tb Exp $	*/
+/*	$OpenBSD: ieee80211_input.c,v 1.194 2017/06/04 12:48:42 tb Exp $	*/
 
 /*-
  * Copyright (c) 2001 Atsushi Onoe
@@ -1362,14 +1362,17 @@ ieee80211_parse_wpa(struct ieee80211com *ic, const u_int8_t *frm,
 int
 ieee80211_save_ie(const u_int8_t *frm, u_int8_t **ie)
 {
-	if (*ie == NULL || (*ie)[1] != frm[1]) {
+	int olen = *ie ? 2 + (*ie)[1] : 0;
+	int len = 2 + frm[1];
+
+	if (*ie == NULL || olen != len) {
 		if (*ie != NULL)
-			free(*ie, M_DEVBUF, 0);
-		*ie = malloc(2 + frm[1], M_DEVBUF, M_NOWAIT);
+			free(*ie, M_DEVBUF, olen);
+		*ie = malloc(len, M_DEVBUF, M_NOWAIT);
 		if (*ie == NULL)
 			return ENOMEM;
 	}
-	memcpy(*ie, frm, 2 + frm[1]);
+	memcpy(*ie, frm, len);
 	return 0;
 }
 
diff --git a/sys/net80211/ieee80211_node.c b/sys/net80211/ieee80211_node.c
index dc57e039d6c..9fbf4a3c645 100644
--- a/sys/net80211/ieee80211_node.c
+++ b/sys/net80211/ieee80211_node.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_node.c,v 1.116 2017/06/03 15:44:03 tb Exp $	*/
+/*	$OpenBSD: ieee80211_node.c,v 1.117 2017/06/04 12:48:42 tb Exp $	*/
 /*	$NetBSD: ieee80211_node.c,v 1.14 2004/05/09 09:18:47 dyoung Exp $	*/
 
 /*-
@@ -791,7 +791,7 @@ void
 ieee80211_node_cleanup(struct ieee80211com *ic, struct ieee80211_node *ni)
 {
 	if (ni->ni_rsnie != NULL) {
-		free(ni->ni_rsnie, M_DEVBUF, 0);
+		free(ni->ni_rsnie, M_DEVBUF, 2 + ni->ni_rsnie[1]);
 		ni->ni_rsnie = NULL;
 	}
 	ieee80211_ba_del(ni);
-- 
2.20.1