WNM: Use cleaner way of generating pointer to a field (CID 68100)

The Action code field is in a fixed location, so the IEEE80211_HDRLEN
can be used here to clean up bounds checking to avoid false reports from
static analyzer.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index e395ef1..4a792c4 100644 (file)
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -921,8 +921,7 @@ void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
        if (len < IEEE80211_HDRLEN + 2)
                return;
 
-       pos = &mgmt->u.action.category;
-       pos++;
+       pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
        act = *pos++;
        end = ((const u8 *) mgmt) + len;