Simplify wpa_bss_get_vendor_ie_multi_beacon() bounds checking

This makes it easier for static analyzers to understand.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c
index 429c6e7547707f46c65b5bbf0b5683050b7252e6..eb97a618d043adc3bf00666e14b065a8ca2b6bec 100644 (file)
--- a/wpa_supplicant/bss.c
+++ b/wpa_supplicant/bss.c
@@ -1281,12 +1281,16 @@ struct wpabuf * wpa_bss_get_vendor_ie_multi_beacon(const struct wpa_bss *bss,
        end = pos + bss->beacon_ie_len;
 
        while (end - pos > 1) {
-               if (2 + pos[1] > end - pos)
+               u8 id, len;
+
+               id = *pos++;
+               len = *pos++;
+               if (len > end - pos)
                        break;
-               if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
-                   vendor_type == WPA_GET_BE32(&pos[2]))
-                       wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4);
-               pos += 2 + pos[1];
+               if (id == WLAN_EID_VENDOR_SPECIFIC && len >= 4 &&
+                   vendor_type == WPA_GET_BE32(pos))
+                       wpabuf_put_data(buf, pos + 4, len - 4);
+               pos += len;
        }
 
        if (wpabuf_len(buf) == 0) {