From cad371a59dde5dd1170d82bc0cbfaabeea587bb2 Mon Sep 17 00:00:00 2001 From: Cedric Izoard Date: Tue, 14 Apr 2020 20:35:07 +0200 Subject: [PATCH] ieee80211: Fix length in vendor specific ANQP data subset For Vendor Specific ANQP element the OUI is not included in the packet subset dissected by the anqp vendor specific function so adapt the length accordingly. Bug: 16494 Change-Id: I8082fdabc379cb3ea71c01e6fb009f49afd16dff Reviewed-on: https://code.wireshark.org/review/36866 Petri-Dish: Anders Broman Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman --- epan/dissectors/packet-ieee80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/epan/dissectors/packet-ieee80211.c b/epan/dissectors/packet-ieee80211.c index 0e98bb6404..f40a15cd91 100644 --- a/epan/dissectors/packet-ieee80211.c +++ b/epan/dissectors/packet-ieee80211.c @@ -8630,7 +8630,7 @@ dissect_anqp_info(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int offse case ANQP_INFO_ANQP_VENDOR_SPECIFIC_LIST: proto_tree_add_item_ret_uint(tree, hf_ieee80211_tag_oui, tvb, offset, 3, ENC_BIG_ENDIAN, &oui); offset += 3; - vendor_tvb = tvb_new_subset_length(tvb, offset, len); + vendor_tvb = tvb_new_subset_length(tvb, offset, len - 3); anqp_info.request = request; anqp_info.idx = idx;