TDLS: Filter AID value properly for VHT peers

IEEE 802.11 standard sends AID in a field that is defined in a bit
strange way to set two MSBs to ones. That is not the real AID and those
extra bits need to be filtered from the value before passing this to the
driver.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c
index 2329033ea0f4004389071ca48b4181d3337ab3cd..93e8cf6924eed7dd783fd2cf7699443d653cbb75 100644 (file)
--- a/src/rsn_supp/wpa_ie.c
+++ b/src/rsn_supp/wpa_ie.c
@@ -549,7 +549,7 @@ int wpa_supplicant_parse_ies(const u8 *buf, size_t len,
                        ie->ht_capabilities_len = pos[1];
                } else if (*pos == WLAN_EID_VHT_AID) {
                        if (pos[1] >= 2)
-                               ie->aid = WPA_GET_LE16(pos + 2);
+                               ie->aid = WPA_GET_LE16(pos + 2) & 0x3fff;
                } else if (*pos == WLAN_EID_VHT_CAP) {
                        ie->vht_capabilities = pos + 2;
                        ie->vht_capabilities_len = pos[1];