diff options
| author | Dmitry Shmidt <dimitrysh@google.com> | 2014-02-28 11:14:23 -0800 |
|---|---|---|
| committer | Dmitry Shmidt <dimitrysh@google.com> | 2014-02-28 11:14:23 -0800 |
| commit | 4582d2a5dd8180c52eb95b1100fb183b9a289708 (patch) | |
| tree | d7b21dc7eacca31acec9b2ad343761006610bff8 /src/rsn_supp | |
| parent | f21452aea786ac056eb01f1cbba4f553bd502747 (diff) | |
| download | android_external_wpa_supplicant_8-4582d2a5dd8180c52eb95b1100fb183b9a289708.tar.gz android_external_wpa_supplicant_8-4582d2a5dd8180c52eb95b1100fb183b9a289708.tar.bz2 android_external_wpa_supplicant_8-4582d2a5dd8180c52eb95b1100fb183b9a289708.zip | |
Cumulative patch from commit 06c7b7f0b5f4deed675a7b81e33830311da7339a
06c7b7f HS 2.0R2: Fix temporary network disabling in Deauth Req case
c5c2d94 P2P: Cancel offchannel TX wait on PD Response TX status
1578796 TDLS: Work around interop issues with supported operating class
b7fb98f Interworking: Fix already-connected check to verify network priority
7c373ac Interworking: Fix last-network preference to not override priority
f54e924 HS 2.0R2: Fix req_conn_capab example
Change-Id: I17953fc05421bc5d454f4081fbfe303f4bf2d6fd
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Diffstat (limited to 'src/rsn_supp')
| -rw-r--r-- | src/rsn_supp/wpa_ie.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c index 9c111839..610b65a8 100644 --- a/src/rsn_supp/wpa_ie.c +++ b/src/rsn_supp/wpa_ie.c @@ -522,8 +522,16 @@ int wpa_supplicant_parse_ies(const u8 *buf, size_t len, ie->supp_channels = pos + 2; ie->supp_channels_len = pos[1]; } else if (*pos == WLAN_EID_SUPPORTED_OPERATING_CLASSES) { - ie->supp_oper_classes = pos + 2; - ie->supp_oper_classes_len = pos[1]; + /* + * The value of the Length field of the Supported + * Operating Classes element is between 2 and 253. + * Silently skip invalid elements to avoid interop + * issues when trying to use the value. + */ + if (pos[1] >= 2 && pos[1] <= 253) { + ie->supp_oper_classes = pos + 2; + ie->supp_oper_classes_len = pos[1]; + } } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) { ret = wpa_parse_generic(pos, end, ie); if (ret < 0) |