Cumulative patch from commit 5f7e1c06cd428888a2ed4fa763c5da37a873e422

5f7e1c0 Redirect more frames with ext_mgmt_frame_handling=1
7738163 RADIUS server: Copy IPv4 address only when IPv6 is not used
508e24c dbus: Clean up error reporting for TDLS peer address parsing
3b6170b WPS: Remove duplicate variable setting
78789d9 Remove unnecessary variable initialization
a7c37d9 dbus: Remove duplicated variable assignment
e997bc7 Remove a static analyzer warning about unused variable write
ea3b8c1 Do not use a separate variable for tracking first entry in a list
8a4ce28 WPA: Clean up cipher suite counting in write routines
6ed626d Remove unused gid_str pointer update
749fa14 Debug print trailing WPA/RSN IE bytes, if any
a5802c0 OpenSSL: Avoid never-used analyzer warning
7b6e815 Clean up hostapd add_iface error path operations
67adcd2 WNM: Check wpa_s->current_bss more consistently
3ff8073 EAP-FAST: Use clear eap_get_config() result validation
a8716d1 roboswitch: Verify that register read succeeds before comparing res
3d91a04 DFS: Make sure center frequency is always initialized for VHT
fa0a9f5 trace: Fix memory use on no-function name path
bd27b13 Make code path easier for static analyzers
64abb72 nl80211: Allow old r-o-c offchannel TX to be tested
fa72a88 P2P: Fix validation on Invitation Request error path
ca412c7 Remove unreachable return statement
2af4d87 GAS: Fix additional comeback delay with status code 95
07d462c Interworking: Remove unused password setting for SIM credential
3141b82 Add OSEN to proto config field writer
b908c50 Clear hostapd bss entry to NULL on add-interface-failure
0052ce4 atheros: Add support for OSEN

Change-Id: Ifd78a8f8259e5b0f654d3dbadd24c9ab029d3afb
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

2 files changed, 6 insertions, 4 deletions

diff --git a/src/wps/ndef.c b/src/wps/ndef.c
index 2b350647..d45dfc8e 100644
--- a/src/wps/ndef.c
+++ b/src/wps/ndef.c
@@ -148,7 +148,8 @@ static struct wpabuf * ndef_build_record(u8 flags, void *type,
 
 static int wifi_filter(struct ndef_record *record)
 {
-	if (record->type_length != os_strlen(wifi_handover_type))
+	if (record->type == NULL ||
+	    record->type_length != os_strlen(wifi_handover_type))
 		return 0;
 	if (os_memcmp(record->type, wifi_handover_type,
 		      os_strlen(wifi_handover_type)) != 0)
@@ -173,7 +174,8 @@ struct wpabuf * ndef_build_wifi(const struct wpabuf *buf)
 
 static int p2p_filter(struct ndef_record *record)
 {
-	if (record->type_length != os_strlen(p2p_handover_type))
+	if (record->type == NULL ||
+	    record->type_length != os_strlen(p2p_handover_type))
 		return 0;
 	if (os_memcmp(record->type, p2p_handover_type,
 		      os_strlen(p2p_handover_type)) != 0)
diff --git a/src/wps/wps_upnp_web.c b/src/wps/wps_upnp_web.c
index 2a3b6360..54c3658a 100644
--- a/src/wps/wps_upnp_web.c
+++ b/src/wps/wps_upnp_web.c
@@ -946,7 +946,7 @@ static void web_connection_parse_subscribe(struct upnp_wps_device_sm *sm,
 	wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP SUBSCRIBE for event");
 	end = os_strchr(h, '\n');
 
-	for (; end != NULL; h = end + 1) {
+	while (end) {
 		/* Option line by option line */
 		h = end + 1;
 		end = os_strchr(h, '\n');
@@ -1153,7 +1153,7 @@ static void web_connection_parse_unsubscribe(struct upnp_wps_device_sm *sm,
 	wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP UNSUBSCRIBE for event");
 	end = os_strchr(h, '\n');
 
-	for (; end != NULL; h = end + 1) {
+	while (end) {
 		/* Option line by option line */
 		h = end + 1;
 		end = os_strchr(h, '\n');