869 	const u8 *pos2;  in hs20_osu_add_prov()  local
902 	pos2 = pos;  in hs20_osu_add_prov()
906 	while (pos - pos2 >= 4 && prov->friendly_name_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
908 		if (1 + pos2[0] > pos - pos2 || pos2[0] < 3) {  in hs20_osu_add_prov()
913 		os_memcpy(f->lang, pos2 + 1, 3);  in hs20_osu_add_prov()
914 		os_memcpy(f->text, pos2 + 1 + 3, pos2[0] - 3);  in hs20_osu_add_prov()
915 		pos2 += 1 + pos2[0];  in hs20_osu_add_prov()
945 	pos2 = pos + 1;  in hs20_osu_add_prov()
947 	while (pos2 < pos) {  in hs20_osu_add_prov()
948 		if (*pos2 < 32)  in hs20_osu_add_prov()
949 			prov->osu_methods |= BIT(*pos2);  in hs20_osu_add_prov()
950 		pos2++;  in hs20_osu_add_prov()
966 	pos2 = pos;  in hs20_osu_add_prov()
970 	while (pos2 < pos) {  in hs20_osu_add_prov()
974 		if (2 + 2 + 3 + 1 + 1 > pos - pos2) {  in hs20_osu_add_prov()
979 		icon->width = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
980 		pos2 += 2;  in hs20_osu_add_prov()
981 		icon->height = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
982 		pos2 += 2;  in hs20_osu_add_prov()
983 		os_memcpy(icon->lang, pos2, 3);  in hs20_osu_add_prov()
984 		pos2 += 3;  in hs20_osu_add_prov()
986 		flen = *pos2++;  in hs20_osu_add_prov()
987 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
991 		os_memcpy(icon->icon_type, pos2, flen);  in hs20_osu_add_prov()
992 		pos2 += flen;  in hs20_osu_add_prov()
994 		if (pos - pos2 < 1) {  in hs20_osu_add_prov()
999 		flen = *pos2++;  in hs20_osu_add_prov()
1000 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
1005 		os_memcpy(icon->filename, pos2, flen);  in hs20_osu_add_prov()
1006 		pos2 += flen;  in hs20_osu_add_prov()
1037 	pos2 = pos;  in hs20_osu_add_prov()
1041 	while (pos - pos2 >= 4 && prov->serv_desc_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
1045 		descr_len = *pos2++;  in hs20_osu_add_prov()
1046 		if (descr_len > pos - pos2 || descr_len < 3) {  in hs20_osu_add_prov()
1052 		os_memcpy(f->lang, pos2, 3);  in hs20_osu_add_prov()
1053 		os_memcpy(f->text, pos2 + 3, descr_len - 3);  in hs20_osu_add_prov()
1054 		pos2 += descr_len;  in hs20_osu_add_prov()