WNM: Reject requests with an invalid dialog token

The dialog token must be non-zero. We are using this fact internally to
track the state in some cases, so ensure that the assumption is valid.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 52d8fb40fc4d2837489c1d9dff3136a5010d7466..b6c5455d60bf1cd7180be4f52ec2b96c587bc258 100644 (file)
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -1456,6 +1456,12 @@ static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
                   wpa_s->wnm_dialog_token, wpa_s->wnm_mode,
                   wpa_s->wnm_disassoc_timer, valid_int);
 
+       if (!wpa_s->wnm_dialog_token) {
+               wpa_printf(MSG_DEBUG, "WNM: Invalid dialog token");
+               wnm_btm_reset(wpa_s);
+               return;
+       }
+
 #if defined(CONFIG_MBO) && defined(CONFIG_TESTING_OPTIONS)
        if (wpa_s->reject_btm_req_reason) {
                wpa_printf(MSG_INFO,