From 56a1df71e54dbc9d4ff807bbf89e13164caa9583 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 3 Nov 2020 20:36:15 +0200 Subject: [PATCH] BSS: Convert wpa_bss_get_vendor_ie() to use for_each_element_id() Use the common IE parsing routine in hope of trying to make the length checks easier for static analyzers. Signed-off-by: Jouni Malinen --- wpa_supplicant/bss.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c index 17c5a4e98..97aa146c8 100644 --- a/wpa_supplicant/bss.c +++ b/wpa_supplicant/bss.c @@ -1154,18 +1154,15 @@ const u8 * wpa_bss_get_ie(const struct wpa_bss *bss, u8 ie) */ const u8 * wpa_bss_get_vendor_ie(const struct wpa_bss *bss, u32 vendor_type) { - const u8 *end, *pos; + const u8 *ies; + const struct element *elem; - pos = (const u8 *) (bss + 1); - end = pos + bss->ie_len; + ies = (const u8 *) (bss + 1); - while (end - pos > 1) { - if (2 + pos[1] > end - pos) - break; - if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && - vendor_type == WPA_GET_BE32(&pos[2])) - return pos; - pos += 2 + pos[1]; + for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies, bss->ie_len) { + if (elem->datalen >= 4 && + vendor_type == WPA_GET_BE32(elem->data)) + return &elem->id; } return NULL;