DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

EHT: Fix invalid length checking for EHT Capability element

Browse source 
Do not consider optional octets maximum lengths when validating EHT
fixed fields length. Furthermore, do not use the first two octets of the
PPE Thresholds field without explicitly confirming that these octets
were included in the element and fix PPE Thresholds field length
calculation.

Fixes: a6d1b4c46c ("EHT: Process (Re)Association Request frame capabilities")
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
This commit is contained in:
Veerendranath Jakkam 2022-05-04 00:34:45 +05:30 • committed by Jouni Malinen
parent 6c7b2be424
commit 50d8837106
2 changed files with 20 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/common/ieee802_11_defs.h
View file

@ -2495,9 +2495,9 @@ struct ieee80211_eht_operation {
#define EHT_PPE_THRES_NSS_MASK ((u8) (BIT(0) | BIT(1) | \
BIT(2) | BIT(3)))
#define EHT_PPE_THRES_RU_INDEX_SHIFT 4
#define EHT_PPE_THRES_RU_INDEX_MASK ((u8) (BIT(4) | BIT(5) | \
BIT(6) | BIT(7) | \
BIT(8)))
#define EHT_PPE_THRES_RU_INDEX_MASK ((u16) (BIT(4) | BIT(5) | \
BIT(6) | BIT(7) | \
BIT(8)))
#define EHT_NSS_MAX_STREAMS 8