commit fc69c6e31ccd348de0ee5cd8b34c7a670f71ef70
author android-build-team Robot <android-build-team-robot@google.com> Mon Jan 14 22:11:53 2019 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Mon Jan 14 22:11:53 2019 +0000
tree 8cd98b4e9c39f8cca7d8fa493050a2c98200be47
parent b821e32036251adb6c238c50011bb3442125f52e
parent 2a1f6c3c5dcc921371ba8a3590b3fd026451e0a1

Snap for 5230900 from 2a1f6c3c5dcc921371ba8a3590b3fd026451e0a1 to pi-platform-release

Change-Id: Ib001b12e6dfc03c57743469b509a3dd36efe0c9f

src/ap/wnm_ap.c

diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 7c4fde0..adb66c1 100644
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -200,6 +200,13 @@
 	u8 *tfsreq_ie_end = NULL;
 	u16 tfsreq_ie_len = 0;
 
+	if (len < 1) {
+		wpa_printf(MSG_DEBUG,
+			   "WNM: Ignore too short WNM-Sleep Mode Request from "
+			   MACSTR, MAC2STR(addr));
+		return;
+	}
+
 	dialog_token = *pos++;
 	while (pos + 1 < frm + len) {
 		u8 ie_len = pos[1];