Support multiple 20/40 BSS Intolerant Channel Report elements

This extends 20/40 BSS Coexistence Management frame processing to
iterate over all the included 20/40 BSS Intolerant Channel Report
elements instead of using only the first one.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/ap/ieee802_11_ht.c b/src/ap/ieee802_11_ht.c
index 74c0ec547151d2a69ab1fcf293823814412b2afc..27f3885880b319de9617dc67078420ef9c5c4a9c 100644 (file)
--- a/src/ap/ieee802_11_ht.c
+++ b/src/ap/ieee802_11_ht.c
@@ -313,8 +313,8 @@ void hostapd_2040_coex_action(struct hostapd_data *hapd,
        }
 
        /* 20/40 BSS Intolerant Channel Report element (zero or more times) */
-       if (start + len - data >= 3 &&
-           data[0] == WLAN_EID_20_40_BSS_INTOLERANT && data[1] >= 1) {
+       while (start + len - data >= 3 &&
+              data[0] == WLAN_EID_20_40_BSS_INTOLERANT && data[1] >= 1) {
                u8 ielen = data[1];
 
                if (ielen > start + len - data - 2) {
@@ -341,6 +341,8 @@ void hostapd_2040_coex_action(struct hostapd_data *hapd,
                                       chan);
                        is_ht40_allowed = 0;
                }
+
+               data += 2 + ielen;
        }
        wpa_printf(MSG_DEBUG, "is_ht40_allowed=%d num_sta_ht40_intolerant=%d",
                   is_ht40_allowed, iface->num_sta_ht40_intolerant);