Skip to content

Conversation

mcoops
Copy link
Contributor

@mcoops mcoops commented Jun 5, 2024

Move offset check within check for vendor extension (221) as this appears to be a bug as the else statement never uses . Previously this would cause small elements to fail processing as it wasn't limited to only vendor elements.

Small Dot11InformationElements that were failing included:

Tag: Power Constraint: 0
    Tag Number: Power Constraint (32)
    Tag length: 1
    Local Power Constraint: 0
// 0x20, 0x01, 0x00

and

Tag: ERP Information
    Tag Number: ERP Information (47)
    Tag length: 1
    ERP Information: 0x00

// 0x2f, 0x01, 0x00

The len(data) < offset+4 is a valid check, but only for a vendor specific element such as:

Tag: Vendor Specific: Broadcom
    Tag Number: Vendor Specific (221)
    Tag length: 9
    OUI: 00:10:18 (Broadcom)
    Vendor Specific OUI Type: 2
    Vendor Specific Data: 0201000c0000

// 0xdd, 0x09, 0x00, 0x10, 0x18, 0x02, 0x01, 0x00, 0x0c, 0x00, 0x00

As other elements don't contain this OUI+Type.

Move offset check within check for vendor extension (221) as this appears to be a bug as the else statement never uses offset+4. Previously this would cause small elements to fail processing as it wasn't limited to only vendor elements.
@mosajjal mosajjal merged commit 2e384c7 into gopacket:master Nov 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants