819 	struct iw_event iwe_buf, *iwe = &iwe_buf;  in hostapd_wireless_event_wireless()  local
830 			   iwe->cmd, iwe->len);  in hostapd_wireless_event_wireless()
831 		if (iwe->len <= IW_EV_LCP_LEN || iwe->len > end - pos)  in hostapd_wireless_event_wireless()
836 		    (iwe->cmd == IWEVMICHAELMICFAILURE ||  in hostapd_wireless_event_wireless()
837 		     iwe->cmd == IWEVCUSTOM)) {  in hostapd_wireless_event_wireless()
848 		switch (iwe->cmd) {  in hostapd_wireless_event_wireless()
850 			if (iwe->u.data.length > end - custom)  in hostapd_wireless_event_wireless()
852 			buf = malloc(iwe->u.data.length + 1);  in hostapd_wireless_event_wireless()
855 			memcpy(buf, custom, iwe->u.data.length);  in hostapd_wireless_event_wireless()
856 			buf[iwe->u.data.length] = '\0';  in hostapd_wireless_event_wireless()
862 		pos += iwe->len;  in hostapd_wireless_event_wireless()