commit ef148e26cad6a849cff11e178e98c173de4323be
author android-build-team Robot <android-build-team-robot@google.com> Tue May 07 21:42:50 2019 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Tue May 07 21:42:50 2019 +0000
tree d66fa1e18f4737b6013e6ac0a2ea494988ec3ce9
parent 2e74e8ac45effa092b36711962f2e3909ae1931b
parent 8610e28428a87ec820772e4eb8934161062d2414

Snap for 5450365 from 8610e28428a87ec820772e4eb8934161062d2414 to pi-platform-release

Change-Id: I8a8dec812bf6b08e9a5072c0f734f1cf5967b305

wpa_supplicant/wnm_sta.c

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 28346ea..3e27f0c 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -373,6 +373,10 @@
 		rep->preference_present = 1;
 		break;
 	case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
+		if (elen < 10) {
+			wpa_printf(MSG_DEBUG, "WNM: Too short bss_term_tsf");
+			break;
+		}
 		rep->bss_term_tsf = WPA_GET_LE64(pos);
 		rep->bss_term_dur = WPA_GET_LE16(pos + 8);
 		rep->bss_term_present = 1;