Simplify DSSS Parameter Set element parsing
Check the element length in the parser and remove the length field from
struct ieee802_11_elems since the only allowed element length is one.
Signed-off-by: Jouni Malinen <j@w1.fi>
diff --git a/src/ap/ap_list.c b/src/ap/ap_list.c
index 04a56a9..8cccd83 100644
--- a/src/ap/ap_list.c
+++ b/src/ap/ap_list.c
@@ -198,7 +198,7 @@
else
ap->erp = -1;
- if (elems->ds_params && elems->ds_params_len == 1)
+ if (elems->ds_params)
ap->channel = elems->ds_params[0];
else if (elems->ht_operation && elems->ht_operation_len >= 1)
ap->channel = elems->ht_operation[0];
diff --git a/src/ap/beacon.c b/src/ap/beacon.c
index ad371f4..7009855 100644
--- a/src/ap/beacon.c
+++ b/src/ap/beacon.c
@@ -588,7 +588,7 @@
* is less likely to see them (Probe Request frame sent on a
* neighboring, but partially overlapping, channel).
*/
- if (elems.ds_params && elems.ds_params_len == 1 &&
+ if (elems.ds_params &&
hapd->iface->current_mode &&
(hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G ||
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211B) &&
diff --git a/src/common/ieee802_11_common.c b/src/common/ieee802_11_common.c
index 350e955..140f920 100644
--- a/src/common/ieee802_11_common.c
+++ b/src/common/ieee802_11_common.c
@@ -211,8 +211,9 @@
elems->supp_rates_len = elen;
break;
case WLAN_EID_DS_PARAMS:
+ if (elen < 1)
+ break;
elems->ds_params = pos;
- elems->ds_params_len = elen;
break;
case WLAN_EID_CF_PARAMS:
case WLAN_EID_TIM:
diff --git a/src/common/ieee802_11_common.h b/src/common/ieee802_11_common.h
index 7f0b296..0a71bc8 100644
--- a/src/common/ieee802_11_common.h
+++ b/src/common/ieee802_11_common.h
@@ -51,7 +51,6 @@
u8 ssid_len;
u8 supp_rates_len;
- u8 ds_params_len;
u8 challenge_len;
u8 erp_info_len;
u8 ext_supp_rates_len;
diff --git a/src/p2p/p2p_parse.c b/src/p2p/p2p_parse.c
index def41ff..980dddf 100644
--- a/src/p2p/p2p_parse.c
+++ b/src/p2p/p2p_parse.c
@@ -516,7 +516,7 @@
struct ieee802_11_elems elems;
ieee802_11_parse_elems(data, len, &elems, 0);
- if (elems.ds_params && elems.ds_params_len >= 1)
+ if (elems.ds_params)
msg->ds_params = elems.ds_params;
if (elems.ssid)
msg->ssid = elems.ssid - 2;