TDLS: Validate ext_supp_rates in copy_supp_rates

The ext_supp_rates passed to merge_byte_arrays would be invalid if not
advertized by the TDLS peer. Thus, validate the argument to avoid
crashes in such cases.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c
index 221d5fd..539aa25 100644 (file)
--- a/src/rsn_supp/tdls.c
+++ b/src/rsn_supp/tdls.c
@@ -1347,7 +1347,8 @@ static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
        peer->supp_rates_len = merge_byte_arrays(
                peer->supp_rates, sizeof(peer->supp_rates),
                kde->supp_rates + 2, kde->supp_rates_len - 2,
-               kde->ext_supp_rates + 2, kde->ext_supp_rates_len - 2);
+               kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL,
+               kde->ext_supp_rates_len - 2);
        return 0;
 }