From: Jouni Malinen <jouni.malinen@atheros.com>
Date: Thu, 14 Apr 2011 17:02:31 +0000 (+0300)
Subject: WPS: Fix off-by-one check in vendor extension parsing
X-Git-Tag: hostap-1-bp~404
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c8d88a145bb1d585eb8864c994e171a49c4ab882;p=thirdparty%2Fhostap.git

WPS: Fix off-by-one check in vendor extension parsing
---

diff --git a/src/wps/wps_attr_parse.c b/src/wps/wps_attr_parse.c
index bc3766c5c..7b462d37c 100644
--- a/src/wps/wps_attr_parse.c
+++ b/src/wps/wps_attr_parse.c
@@ -121,7 +121,7 @@ static int wps_parse_vendor_ext(struct wps_parse_attr *attr, const u8 *pos,
 		return -1;
 	}
 
-	if (attr->num_vendor_ext > MAX_WPS_PARSE_VENDOR_EXT) {
+	if (attr->num_vendor_ext >= MAX_WPS_PARSE_VENDOR_EXT) {
 		wpa_printf(MSG_DEBUG, "WPS: Skipped Vendor Extension "
 			   "attribute (max %d vendor extensions)",
 			   MAX_WPS_PARSE_VENDOR_EXT);