src/p2p/p2p_sd.c

21 	const u8 *pos, *end;
28 	pos = wpabuf_head(wfd);
29 	end = pos + wpabuf_len(wfd);
31 	while (pos + 3 <= end) {
32 		subelem = *pos++;
33 		len = WPA_GET_BE16(pos);
34 		pos += 2;
35 		if (pos + len > end)
39 			u16 info = WPA_GET_BE16(pos);
43 		pos += len;
323 	const u8 *pos = data;
346 	dialog_token = *pos++;
351 	if (*pos != WLAN_EID_ADV_PROTO) {
352 		p2p_dbg(p2p, "Unexpected IE in GAS Initial Request: %u", *pos);
355 	pos++;
357 	slen = *pos++;
358 	next = pos + slen;
363 	pos++; /* skip QueryRespLenLimit and PAME-BI */
365 	if (*pos != ACCESS_NETWORK_QUERY_PROTOCOL) {
367 			*pos);
371 	pos = next;
373 	if (pos + 2 > end)
375 	slen = WPA_GET_LE16(pos);
376 	pos += 2;
377 	if (pos + slen > end)
379 	end = pos + slen;
382 	if (pos + 4 > end)
384 	if (WPA_GET_LE16(pos) != ANQP_VENDOR_SPECIFIC) {
385 		p2p_dbg(p2p, "Unsupported ANQP Info ID %u", WPA_GET_LE16(pos));
388 	pos += 2;
390 	slen = WPA_GET_LE16(pos);
391 	pos += 2;
392 	if (pos + slen > end || slen < 3 + 1) {
397 	if (WPA_GET_BE32(pos) != P2P_IE_VENDOR_TYPE) {
399 			WPA_GET_BE32(pos));
402 	pos += 4;
404 	if (pos + 2 > end)
406 	update_indic = WPA_GET_LE16(pos);
408 	pos += 2;
411 			     update_indic, pos, end - pos);
468 	const u8 *pos = data;
494 	dialog_token = *pos++;
496 	status_code = WPA_GET_LE16(pos);
497 	pos += 2;
498 	comeback_delay = WPA_GET_LE16(pos);
499 	pos += 2;
508 	if (*pos != WLAN_EID_ADV_PROTO) {
509 		p2p_dbg(p2p, "Unexpected IE in GAS Initial Response: %u", *pos);
512 	pos++;
514 	slen = *pos++;
515 	next = pos + slen;
520 	pos++; /* skip QueryRespLenLimit and PAME-BI */
522 	if (*pos != ACCESS_NETWORK_QUERY_PROTOCOL) {
524 			*pos);
528 	pos = next;
530 	if (pos + 2 > end) {
534 	slen = WPA_GET_LE16(pos);
535 	pos += 2;
537 	if (pos + slen > end) {
541 	end = pos + slen;
555 	if (pos + 4 > end)
557 	if (WPA_GET_LE16(pos) != ANQP_VENDOR_SPECIFIC) {
558 		p2p_dbg(p2p, "Unsupported ANQP Info ID %u", WPA_GET_LE16(pos));
561 	pos += 2;
563 	slen = WPA_GET_LE16(pos);
564 	pos += 2;
565 	if (pos + slen > end || slen < 3 + 1) {
570 	if (WPA_GET_BE32(pos) != P2P_IE_VENDOR_TYPE) {
572 			WPA_GET_BE32(pos));
575 	pos += 4;
577 	if (pos + 2 > end)
579 	update_indic = WPA_GET_LE16(pos);
581 	pos += 2;
599 				      pos, end - pos);
673 	const u8 *pos = data;
702 	dialog_token = *pos++;
704 	status_code = WPA_GET_LE16(pos);
705 	pos += 2;
706 	frag_id = *pos & 0x7f;
707 	more_frags = (*pos & 0x80) >> 7;
708 	pos++;
709 	comeback_delay = WPA_GET_LE16(pos);
710 	pos += 2;
722 	if (*pos != WLAN_EID_ADV_PROTO) {
724 			*pos);
727 	pos++;
729 	slen = *pos++;
730 	next = pos + slen;
735 	pos++; /* skip QueryRespLenLimit and PAME-BI */
737 	if (*pos != ACCESS_NETWORK_QUERY_PROTOCOL) {
739 			*pos);
743 	pos = next;
745 	if (pos + 2 > end) {
749 	slen = WPA_GET_LE16(pos);
750 	pos += 2;
752 	if (pos + slen > end) {
760 	end = pos + slen;
771 	if (pos + 4 > end)
773 	if (WPA_GET_LE16(pos) != ANQP_VENDOR_SPECIFIC) {
774 		p2p_dbg(p2p, "Unsupported ANQP Info ID %u", WPA_GET_LE16(pos));
777 	pos += 2;
779 	slen = WPA_GET_LE16(pos);
780 	pos += 2;
786 	if (pos + 4 > end)
789 	if (WPA_GET_BE32(pos) != P2P_IE_VENDOR_TYPE) {
791 			WPA_GET_BE32(pos));
794 	pos += 4;
796 	if (pos + 2 > end)
798 	p2p->sd_rx_update_indic = WPA_GET_LE16(pos);
800 	pos += 2;
803 	if (wpabuf_resize(&p2p->sd_rx_resp, end - pos) < 0)
805 	wpabuf_put_data(p2p->sd_rx_resp, pos, end - pos);