func: static int CVE_2008_5134_VULN_lbs_process_bss(struct bss_descriptor uint8_t **pbeaconinfo, int *bytesleft) struct ieeetypes_countryinfoset * pcountryinfo ; uint8_t * pos , * end , * p ; uint16_t beaconsize = 0 ; if ( * bytesleft >= sizeof ( beaconsize ) )  beaconsize = get_unaligned_le16 ( * pbeaconinfo ); * bytesleft -= sizeof ( beaconsize ); * pbeaconinfo += sizeof ( beaconsize ); if ( beaconsize == 0 || beaconsize > * bytesleft )  pos = * pbeaconinfo; end = pos + beaconsize; memcpy ( bss -> bssid , pos , ETH_ALEN ); pos += ETH_ALEN; if ( ( end - pos ) < 12 )  bss -> rssi = * pos; pos ++; pos += 8; bss -> beaconperiod = get_unaligned_le16 ( pos ); pos += 2; bss -> capability = get_unaligned_le16 ( pos ); pos += 2; if ( bss -> capability & WLAN_CAPABILITY_IBSS )  bss -> mode = IW_MODE_INFRA; while ( pos <= end - 2 )  struct ieee80211_info_element * elem = ( void * ) pos ; if ( pos + elem -> len > end )  switch ( elem -> id )  bss -> ssid_len = elem -> len; memcpy ( bss -> ssid , elem -> data , elem -> len ); lbs_deb_scan ( "got SSID IE: '%s', len %u\n" , escape_essid ( bss -> ssid , bss -> ssid_len ) , bss -> ssid_len ); memcpy ( bss -> rates , elem -> data , n_basic_rates ); memmove ( & bss -> phyparamset . fhparamset , pFH , sizeof ( struct ieeetypes_fhparamset ) ); bss -> channel = pDS -> currentchan; memcpy ( & bss -> phyparamset . dsparamset , pDS , sizeof ( struct ieeetypes_dsparamset ) ); lbs_deb_scan ( "got DS IE, channel %d\n" , bss -> channel ); memcpy ( & bss -> ssparamset . cfparamset , pCF , sizeof ( struct ieeetypes_cfparamset ) ); bss -> atimwindow = le16_to_cpu ( pibss -> atimwindow ); memmove ( & bss -> ssparamset . ibssparamset , pibss , sizeof ( struct ieeetypes_ibssparamset ) ); pcountryinfo = ( struct ieeetypes_countryinfoset * ) pos; if ( pcountryinfo -> len < sizeof ( pcountryinfo -> countrycode ) || pcountryinfo -> len > 254 )  memcpy ( & bss -> countryinfo , pcountryinfo , pcountryinfo -> len + 2 ); p = bss -> rates + n_basic_rates; memcpy ( p , elem -> data , n_ex_rates ); bss -> wpa_ie_len = min ( elem -> len + 2 , MAX_WPA_IE_LEN ); memcpy ( bss -> wpa_ie , elem , bss -> wpa_ie_len ); lbs_deb_hex ( LBS_DEB_SCAN , "WPA IE" , bss -> wpa_ie , elem -> len ); pos += elem -> len + 2; 