BSS: Convert wpa_bss_get_vendor_ie() to use for_each_element_id()

Use the common IE parsing routine in hope of trying to make the length
checks easier for static analyzers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c
index 17c5a4e9897126bbb348a750bfa19fa5d3f65d8f..97aa146c85dc7908419559358bae604fff1a40ff 100644 (file)
--- a/wpa_supplicant/bss.c
+++ b/wpa_supplicant/bss.c
@@ -1154,18 +1154,15 @@ const u8 * wpa_bss_get_ie(const struct wpa_bss *bss, u8 ie)
  */
 const u8 * wpa_bss_get_vendor_ie(const struct wpa_bss *bss, u32 vendor_type)
 {
-       const u8 *end, *pos;
+       const u8 *ies;
+       const struct element *elem;
 
-       pos = (const u8 *) (bss + 1);
-       end = pos + bss->ie_len;
+       ies = (const u8 *) (bss + 1);
 
-       while (end - pos > 1) {
-               if (2 + pos[1] > end - pos)
-                       break;
-               if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
-                   vendor_type == WPA_GET_BE32(&pos[2]))
-                       return pos;
-               pos += 2 + pos[1];
+       for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies, bss->ie_len) {
+               if (elem->datalen >= 4 &&
+                   vendor_type == WPA_GET_BE32(elem->data))
+                       return &elem->id;
        }
 
        return NULL;