[PATCH] iw: scan: more length checks for print_wifi_wps()

[Markus Theil <markus.theil@xxxxxxxxxxxxx>]

Signed-off-by: Markus Theil <markus.theil@xxxxxxxxxxxxx>
---
 scan.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/scan.c b/scan.c
index dbfe44c..2dedd64 100644
--- a/scan.c
+++ b/scan.c
@@ -1878,6 +1878,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			break;
 		}
 		case 0x103c: {
+			if (sublen < 1) {
+				printf("\t * RF Bands: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * RF Bands: 0x%x\n", val);
@@ -1941,6 +1946,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			break;
 		}
 		case 0x1057: {
+			if (sublen < 1) {
+				printf("\t * AP setup locked: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * AP setup locked: 0x%.2x\n", val);
-- 
2.25.0