Allow RSNE Override element to override RSNE contents during parsing

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index 1cfdd9ad7e2ff91ad01be7e1920c10d188a9b2c5..8eb4a1dabd64f93d7f8c14f4d2027b8539690f85 100644 (file)
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -1890,6 +1890,14 @@ int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
                data->has_group = 1;
                data->key_mgmt = WPA_KEY_MGMT_OSEN;
                data->proto = WPA_PROTO_OSEN;
+       } else if (rsn_ie_len >= 2 + 4 + 2 && rsn_ie[1] >= 4 + 2 &&
+                  rsn_ie[1] == rsn_ie_len - 2 &&
+                  (WPA_GET_BE32(&rsn_ie[2]) == RSNE_OVERRIDE_IE_VENDOR_TYPE ||
+                   WPA_GET_BE32(&rsn_ie[2]) ==
+                   RSNE_OVERRIDE_2_IE_VENDOR_TYPE) &&
+                  WPA_GET_LE16(&rsn_ie[2 + 4]) == RSN_VERSION) {
+               pos = rsn_ie + 2 + 4 + 2;
+               left = rsn_ie_len - 2 - 4 - 2;
        } else {
                const struct rsn_ie_hdr *hdr;