828 	struct iw_event iwe_buf, *iwe = &iwe_buf;  in hostapd_wireless_event_wireless()  local
839 			   iwe->cmd, iwe->len);  in hostapd_wireless_event_wireless()
840 		if (iwe->len <= IW_EV_LCP_LEN || iwe->len > end - pos)  in hostapd_wireless_event_wireless()
845 		    (iwe->cmd == IWEVMICHAELMICFAILURE ||  in hostapd_wireless_event_wireless()
846 		     iwe->cmd == IWEVCUSTOM)) {  in hostapd_wireless_event_wireless()
857 		switch (iwe->cmd) {  in hostapd_wireless_event_wireless()
859 			if (iwe->u.data.length > end - custom)  in hostapd_wireless_event_wireless()
861 			buf = malloc(iwe->u.data.length + 1);  in hostapd_wireless_event_wireless()
864 			memcpy(buf, custom, iwe->u.data.length);  in hostapd_wireless_event_wireless()
865 			buf[iwe->u.data.length] = '\0';  in hostapd_wireless_event_wireless()
871 		pos += iwe->len;  in hostapd_wireless_event_wireless()