From b859b9bceadccd882252ff0aa2fdba0d3b91764e Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 8 May 2022 17:28:58 +0300 Subject: [PATCH] Simplify wpa_bss_get_vendor_ie_multi_beacon() bounds checking This makes it easier for static analyzers to understand. Signed-off-by: Jouni Malinen --- wpa_supplicant/bss.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c index 429c6e754..eb97a618d 100644 --- a/wpa_supplicant/bss.c +++ b/wpa_supplicant/bss.c @@ -1281,12 +1281,16 @@ struct wpabuf * wpa_bss_get_vendor_ie_multi_beacon(const struct wpa_bss *bss, end = pos + bss->beacon_ie_len; while (end - pos > 1) { - if (2 + pos[1] > end - pos) + u8 id, len; + + id = *pos++; + len = *pos++; + if (len > end - pos) break; - if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && - vendor_type == WPA_GET_BE32(&pos[2])) - wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4); - pos += 2 + pos[1]; + if (id == WLAN_EID_VENDOR_SPECIFIC && len >= 4 && + vendor_type == WPA_GET_BE32(pos)) + wpabuf_put_data(buf, pos + 4, len - 4); + pos += len; } if (wpabuf_len(buf) == 0) {