RSNO: Support over two octets of RSNXOE capabilities

The RSNXE generation function was extended to support this earlier, but
that update was missed from the RSNXOE variant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
index 79dbe346c7628215a7e8858b72923b22f66c979b..9a02f8e5dff576363a2a02afa59207ad3d1d4faf 100644 (file)
--- a/src/ap/wpa_auth_ie.c
+++ b/src/ap/wpa_auth_ie.c
@@ -547,15 +547,20 @@ static int wpa_write_rsnxe_override(struct wpa_auth_config *conf, u8 *buf,
                                    size_t len)
 {
        u8 *pos = buf;
-       u16 capab;
+       u32 capab, tmp;
        size_t flen;
 
        capab = rsnxe_capab(conf, conf->rsn_override_key_mgmt |
                            conf->rsn_override_key_mgmt_2);
 
-       flen = (capab & 0xff00) ? 2 : 1;
        if (!capab)
                return 0; /* no supported extended RSN capabilities */
+       tmp = capab;
+       flen = 0;
+       while (tmp) {
+               flen++;
+               tmp >>= 8;
+       }
        if (len < 2 + flen)
                return -1;
        capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
@@ -565,10 +570,10 @@ static int wpa_write_rsnxe_override(struct wpa_auth_config *conf, u8 *buf,
        WPA_PUT_BE32(pos, RSNXE_OVERRIDE_IE_VENDOR_TYPE);
        pos += 4;
 
-       *pos++ = capab & 0x00ff;
-       capab >>= 8;
-       if (capab)
-               *pos++ = capab;
+       while (capab) {
+               *pos++ = capab & 0xff;
+               capab >>= 8;
+       }
 
        return pos - buf;
 }