From 13b30052d998bb3a8b542edf1a24a79b967e1503 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Thu, 9 Feb 2017 13:23:00 +0200 Subject: [PATCH] RRM: Fix Range Request max age parsing This 16-bit field uses little endian encoding and it must be read with WPA_GET_LE16() instead of assuming host byte order is little endian. In addition, this could be misaligned, so using a u16 pointer here was not appropriate. Signed-off-by: Jouni Malinen --- src/ap/rrm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ap/rrm.c b/src/ap/rrm.c index 28e8cc9be..5318b2076 100644 --- a/src/ap/rrm.c +++ b/src/ap/rrm.c @@ -147,7 +147,7 @@ static u16 hostapd_parse_location_lci_req_age(const u8 *buf, size_t len) /* Subelements are arranged as IEs */ subelem = get_ie(buf + 4, len - 4, LCI_REQ_SUBELEM_MAX_AGE); if (subelem && subelem[1] == 2) - return *(u16 *) (subelem + 2); + return WPA_GET_LE16(subelem + 2); return 0; }