WPS: Fix off-by-one check in vendor extension parsing

diff --git a/src/wps/wps_attr_parse.c b/src/wps/wps_attr_parse.c
index bc3766c5cc7422668c6fc7c6abf8383c57413f01..7b462d37c78c4438a74511d4dc14617f49b447b8 100644 (file)
--- a/src/wps/wps_attr_parse.c
+++ b/src/wps/wps_attr_parse.c
@@ -121,7 +121,7 @@ static int wps_parse_vendor_ext(struct wps_parse_attr *attr, const u8 *pos,
                return -1;
        }
 
-       if (attr->num_vendor_ext > MAX_WPS_PARSE_VENDOR_EXT) {
+       if (attr->num_vendor_ext >= MAX_WPS_PARSE_VENDOR_EXT) {
                wpa_printf(MSG_DEBUG, "WPS: Skipped Vendor Extension "
                           "attribute (max %d vendor extensions)",
                           MAX_WPS_PARSE_VENDOR_EXT);