Allow RSNXE Override element to override RSNXE contents during parsing

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/common/ieee802_11_common.c b/src/common/ieee802_11_common.c
index 40a38955dcb696ea6e910e4b8bd0ceeb27c73c92..3ca1ffe7e036dcd562bdec77896126ed99f631f7 100644 (file)
--- a/src/common/ieee802_11_common.c
+++ b/src/common/ieee802_11_common.c
@@ -3131,8 +3131,12 @@ bool ieee802_11_rsnx_capab_len(const u8 *rsnxe, size_t rsnxe_len,
 
 bool ieee802_11_rsnx_capab(const u8 *rsnxe, unsigned int capab)
 {
-       return ieee802_11_rsnx_capab_len(rsnxe ? rsnxe + 2 : NULL,
-                                        rsnxe ? rsnxe[1] : 0, capab);
+       if (!rsnxe)
+               return false;
+       if (rsnxe[0] == WLAN_EID_VENDOR_SPECIFIC && rsnxe[1] >= 4 + 1)
+               return ieee802_11_rsnx_capab_len(rsnxe + 2 + 4, rsnxe[1] - 4,
+                                                capab);
+       return ieee802_11_rsnx_capab_len(rsnxe + 2, rsnxe[1], capab);
 }