864 	const u8 *pos2;  in hs20_osu_add_prov()  local
897 	pos2 = pos;  in hs20_osu_add_prov()
901 	while (pos - pos2 >= 4 && prov->friendly_name_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
905 		slen = pos2[0];  in hs20_osu_add_prov()
906 		if (1 + slen > pos - pos2) {  in hs20_osu_add_prov()
916 		pos2++;  in hs20_osu_add_prov()
917 		os_memcpy(f->lang, pos2, 3);  in hs20_osu_add_prov()
918 		pos2 += 3;  in hs20_osu_add_prov()
920 		os_memcpy(f->text, pos2, slen);  in hs20_osu_add_prov()
921 		pos2 += slen;  in hs20_osu_add_prov()
951 	pos2 = pos + 1;  in hs20_osu_add_prov()
953 	while (pos2 < pos) {  in hs20_osu_add_prov()
954 		if (*pos2 < 32)  in hs20_osu_add_prov()
955 			prov->osu_methods |= BIT(*pos2);  in hs20_osu_add_prov()
956 		pos2++;  in hs20_osu_add_prov()
972 	pos2 = pos;  in hs20_osu_add_prov()
976 	while (pos2 < pos) {  in hs20_osu_add_prov()
980 		if (2 + 2 + 3 + 1 + 1 > pos - pos2) {  in hs20_osu_add_prov()
985 		icon->width = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
986 		pos2 += 2;  in hs20_osu_add_prov()
987 		icon->height = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
988 		pos2 += 2;  in hs20_osu_add_prov()
989 		os_memcpy(icon->lang, pos2, 3);  in hs20_osu_add_prov()
990 		pos2 += 3;  in hs20_osu_add_prov()
992 		flen = *pos2++;  in hs20_osu_add_prov()
993 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
997 		os_memcpy(icon->icon_type, pos2, flen);  in hs20_osu_add_prov()
998 		pos2 += flen;  in hs20_osu_add_prov()
1000 		if (pos - pos2 < 1) {  in hs20_osu_add_prov()
1005 		flen = *pos2++;  in hs20_osu_add_prov()
1006 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
1011 		os_memcpy(icon->filename, pos2, flen);  in hs20_osu_add_prov()
1012 		pos2 += flen;  in hs20_osu_add_prov()
1043 	pos2 = pos;  in hs20_osu_add_prov()
1047 	while (pos - pos2 >= 4 && prov->serv_desc_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
1051 		descr_len = *pos2++;  in hs20_osu_add_prov()
1052 		if (descr_len > pos - pos2 || descr_len < 3) {  in hs20_osu_add_prov()
1058 		os_memcpy(f->lang, pos2, 3);  in hs20_osu_add_prov()
1059 		os_memcpy(f->text, pos2 + 3, descr_len - 3);  in hs20_osu_add_prov()
1060 		pos2 += descr_len;  in hs20_osu_add_prov()