[PATCH 5/8] iw: scan: fix buffer over-read in print_wifi_wps

[Markus Theil <markus.theil@xxxxxxxxxxxxx>]

Signed-off-by: Markus Theil <markus.theil@xxxxxxxxxxxxx>
---
 scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scan.c b/scan.c
index 9a02363..f57925d 100644
--- a/scan.c
+++ b/scan.c
@@ -1818,7 +1818,7 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 	while (len >= 4) {
 		subtype = (data[0] << 8) + data[1];
 		sublen = (data[2] << 8) + data[3];
-		if (sublen > len)
+		if (sublen > len - 4)
 			break;
 
 		switch (subtype) {
-- 
2.25.0