MSCS: Fix issues due to incorrect usage of wpa_hexdump_buf()

Previously wpabuf_head() of the buffer is passed to wpa_hexdump_buf()
instead of the wpabuf struct itself and it was causing wpa_supplicant to
crash. Fix this by using the correct pointer in the debug prints.

Fixes: a118047245b0 ("MSCS: Add support to send MSCS Request frames")
Fixes: c504ff5398fa ("MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq")
Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>

diff --git a/wpa_supplicant/robust_av.c b/wpa_supplicant/robust_av.c
index 31315517a045afbbd6dafed09932b2ebfd768049..4ac1a2bb90e199271a894da08308cb0f9bf7f280 100644 (file)
--- a/wpa_supplicant/robust_av.c
+++ b/wpa_supplicant/robust_av.c
@@ -94,7 +94,7 @@ int wpas_send_mscs_req(struct wpa_supplicant *wpa_s)
        /* MSCS descriptor element */
        wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, buf);
 
-       wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", wpabuf_head(buf));
+       wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", buf);
        ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
                                  wpa_s->own_addr, wpa_s->bssid,
                                  wpabuf_head(buf), wpabuf_len(buf), 0);

diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index 592c742fa25bf3026592f4aa1d6a3691f5836cc2..2faaff930847de7acd819217b9e0fa23c7b3e110 100644 (file)
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -1905,8 +1905,7 @@ pfs_fail:
                max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
                wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
                if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
-                       wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE",
-                                       wpabuf_head(mscs_ie));
+                       wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
                        mscs_ie_len = wpabuf_len(mscs_ie);
                        os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
                                  wpabuf_head(mscs_ie), mscs_ie_len);

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 3d2c0a98501a231ed807230af3e7de83e581415d..39e92fb68228b826983934eba4edead0e78ec08e 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -3214,8 +3214,7 @@ pfs_fail:
 
                wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
                if ((wpa_ie_len + wpabuf_len(mscs_ie)) <= max_wpa_ie_len) {
-                       wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE",
-                                       wpabuf_head(mscs_ie));
+                       wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
                        mscs_ie_len = wpabuf_len(mscs_ie);
                        os_memcpy(wpa_ie + wpa_ie_len, wpabuf_head(mscs_ie),
                                  mscs_ie_len);