[PATCH 1/2] iw: scan: fix endless loop in print_measurement_pilot_tx

[Markus Theil <markus.theil@xxxxxxxxxxxxx>]

---
 scan.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/scan.c b/scan.c
index 98c5c10..a5beb0e 100644
--- a/scan.c
+++ b/scan.c
@@ -1548,6 +1548,7 @@ static void print_measurement_pilot_tx(const uint8_t type, uint8_t len,
 		++p;
 		uint8_t len = *p;
 		++p;
+		const uint8_t *end = p + len;
 
 		len_remaining -= 2;
 
@@ -1557,18 +1558,21 @@ static void print_measurement_pilot_tx(const uint8_t type, uint8_t len,
 			return;
 		}
 
-		printf("\t\t * vendor specific: OUI %.2x:%.2x:%.2x, data:",
-			p[0], p[1], p[2]);
-		len_remaining -= 3;
-
-		if (len > len_remaining) {
+		if (len < 3 || len > len_remaining) {
 			printf(" <Parse error, element too short>\n");
 			return;
 		}
 
-		while (p < p + len)
+		printf("\t\t * vendor specific: OUI %.2x:%.2x:%.2x, data:",
+			p[0], p[1], p[2]);
+		/* add only two here and use ++p in while loop */
+		p += 2;
+
+		while (++p < end)
 			printf(" %.2x", *p);
 		printf("\n");
+
+		len_remaining -= len;
 	}
 }
 
-- 
2.25.0