Merge cherrypicks of [5532243, 5532244, 5532245, 5532246, 5532247, 5532826, 5530552, 5532902, 5530553, 5531520, 5532903, 5530554, 5529581, 5529582, 5531521, 5532979, 5532999, 5532248, 5531522, 5531523, 5531524, 5531525, 5531526, 5529583, 5529584, 5529585, 5529586, 5531351, 5529632, 5530506, 5530507, 5532980, 5533000] into pi-qpr1-release
Change-Id: Ib78f9c8f8ec4ab264a5e48d558560df375fdf993
diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 7c4fde0..adb66c1 100644
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -200,6 +200,13 @@
u8 *tfsreq_ie_end = NULL;
u16 tfsreq_ie_len = 0;
+ if (len < 1) {
+ wpa_printf(MSG_DEBUG,
+ "WNM: Ignore too short WNM-Sleep Mode Request from "
+ MACSTR, MAC2STR(addr));
+ return;
+ }
+
dialog_token = *pos++;
while (pos + 1 < frm + len) {
u8 ie_len = pos[1];