From 73fc617d5c1df9e70c50ff78e1ea84f377c972a7 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Fri, 12 Mar 2010 00:41:03 +0200
Subject: [PATCH] nl80211: Fix FT Action send command

Need to include payload header in the data length to avoid sending
truncated FT Action frame.
---
 src/drivers/driver_nl80211.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index d4679b96f..575976021 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -5126,8 +5126,8 @@ static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
 	 * FT IEs
 	 */
 
-	data_len = ies_len;
-	data = os_malloc(2 + 2 * ETH_ALEN + data_len);
+	data_len = 2 + 2 * ETH_ALEN + ies_len;
+	data = os_malloc(data_len);
 	if (data == NULL)
 		return -1;
 	pos = data;