RRM: Fix Range Request max age parsing

This 16-bit field uses little endian encoding and it must be read with
WPA_GET_LE16() instead of assuming host byte order is little endian. In
addition, this could be misaligned, so using a u16 pointer here was not
appropriate.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/ap/rrm.c b/src/ap/rrm.c
index 28e8cc9be3bb413233b1452cccfdb53af378b0c7..5318b2076125c4ae699338d3c684267d38c0a7ae 100644 (file)
--- a/src/ap/rrm.c
+++ b/src/ap/rrm.c
@@ -147,7 +147,7 @@ static u16 hostapd_parse_location_lci_req_age(const u8 *buf, size_t len)
        /* Subelements are arranged as IEs */
        subelem = get_ie(buf + 4, len - 4, LCI_REQ_SUBELEM_MAX_AGE);
        if (subelem && subelem[1] == 2)
-               return *(u16 *) (subelem + 2);
+               return WPA_GET_LE16(subelem + 2);
 
        return 0;
 }