tree 266bc8bf7b2996c19b26182ee1a89a3f61b33f65
parent 762a0bfb01b1651c728b6deeda06bf965634e390
author Jouni Malinen <j@w1.fi> 1429431358 +0300
committer Jouni Malinen <j@w1.fi> 1429692259 +0300

FT: Fix WMM TSPEC validation in driver-based AP MLME case

Commit 88b32a99d30894b2d6bb391371c442fc117edbab ('FT: Add FT AP support
for drivers that manage MLME internally') added an alternative way of
processing the WMM TSPEC from RIC. However, that change did not seem to
include the same checks for WMM TSPEC element length that were used in
the original implementation for MLME-in-hostapd case. Fix this by
sharing the older implementation of copying the WMM TSPEC from RIC for
both cases.

It looks like the destination buffer for the response is sufficiently
long for the fixed length copy, but it may have been possible to trigger
a read beyond the end of the FTIE by about 50 bytes. Though, that seems
to be within the buffer received for RX buffer in the case that uses
this driver-based AP MLME design for FT.

Signed-off-by: Jouni Malinen <j@w1.fi>