diff options
| author | Ahmed ElArabawy <arabawy@google.com> | 2020-01-09 18:25:18 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-01-09 18:25:18 +0000 |
| commit | c20aac99b6d0e7361fcbfed2bd859bd1368f54c8 (patch) | |
| tree | 49d756bbfb76979443c9b31ac62eaab6396ef199 /service | |
| parent | fbc0dcb846cc397d5388f4a1080a900590a6a4a2 (diff) | |
| parent | 2408148c754fd712d874309e94f0c6e6355ddbdc (diff) | |
Merge "Handle IEs with Extension present and zero length"
Diffstat (limited to 'service')
| -rw-r--r-- | service/java/com/android/server/wifi/util/InformationElementUtil.java | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/service/java/com/android/server/wifi/util/InformationElementUtil.java b/service/java/com/android/server/wifi/util/InformationElementUtil.java index 3ee5d8c9f..a00cf3143 100644 --- a/service/java/com/android/server/wifi/util/InformationElementUtil.java +++ b/service/java/com/android/server/wifi/util/InformationElementUtil.java @@ -61,6 +61,10 @@ public class InformationElementUtil { if (eid == InformationElement.EID_SSID) { found_ssid = true; } else if (eid == InformationElement.EID_EXTENSION_PRESENT) { + if (elementLength == 0) { + // Malformed IE, skipping + break; + } eidExt = data.get() & Constants.BYTE_MASK; elementLength--; } |