b43: Fix tim search buffer overrun

Use the length of the variable section of the beacon instead of the
whole beacon length for bounds checking.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Michael Buesch 2007-12-27 22:15:11 +01:00 committed by David S. Miller
commit 47f76ca3a3