iw: scan: fix buffer over-read in print_wifi_wps

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20200209165902.44110-6-markus.theil@tu-ilmenau.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/scan.c b/scan.c
index e8a7afdfb00d46843ef44dd23f4d96340477e2ff..2114cfe72a266583e5d5058e8337a5a7f3a583db 100644 (file)
--- a/scan.c
+++ b/scan.c
@@ -1827,7 +1827,7 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
        while (len >= 4) {
                subtype = (data[0] << 8) + data[1];
                sublen = (data[2] << 8) + data[3];
-               if (sublen > len)
+               if (sublen > len - 4)
                        break;
 
                switch (subtype) {