Simplify wpa_bss_get_vendor_ie_multi_beacon() bounds checking
This makes it easier for static analyzers to understand. Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
parent
fc9648a6a1
commit
b859b9bcea
1 changed files with 9 additions and 5 deletions
|
@ -1281,12 +1281,16 @@ struct wpabuf * wpa_bss_get_vendor_ie_multi_beacon(const struct wpa_bss *bss,
|
|||
end = pos + bss->beacon_ie_len;
|
||||
|
||||
while (end - pos > 1) {
|
||||
if (2 + pos[1] > end - pos)
|
||||
u8 id, len;
|
||||
|
||||
id = *pos++;
|
||||
len = *pos++;
|
||||
if (len > end - pos)
|
||||
break;
|
||||
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
|
||||
vendor_type == WPA_GET_BE32(&pos[2]))
|
||||
wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4);
|
||||
pos += 2 + pos[1];
|
||||
if (id == WLAN_EID_VENDOR_SPECIFIC && len >= 4 &&
|
||||
vendor_type == WPA_GET_BE32(pos))
|
||||
wpabuf_put_data(buf, pos + 4, len - 4);
|
||||
pos += len;
|
||||
}
|
||||
|
||||
if (wpabuf_len(buf) == 0) {
|
||||
|
|
Loading…
Reference in a new issue