802 	const u8 *pos2;  in hs20_osu_add_prov()  local
832 	pos2 = pos;  in hs20_osu_add_prov()
836 	while (pos - pos2 >= 4 && prov->friendly_name_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
838 		if (1 + pos2[0] > pos - pos2 || pos2[0] < 3) {  in hs20_osu_add_prov()
843 		os_memcpy(f->lang, pos2 + 1, 3);  in hs20_osu_add_prov()
844 		os_memcpy(f->text, pos2 + 1 + 3, pos2[0] - 3);  in hs20_osu_add_prov()
845 		pos2 += 1 + pos2[0];  in hs20_osu_add_prov()
875 	pos2 = pos + 1;  in hs20_osu_add_prov()
877 	while (pos2 < pos) {  in hs20_osu_add_prov()
878 		if (*pos2 < 32)  in hs20_osu_add_prov()
879 			prov->osu_methods |= BIT(*pos2);  in hs20_osu_add_prov()
880 		pos2++;  in hs20_osu_add_prov()
896 	pos2 = pos;  in hs20_osu_add_prov()
900 	while (pos2 < pos) {  in hs20_osu_add_prov()
904 		if (2 + 2 + 3 + 1 + 1 > pos - pos2) {  in hs20_osu_add_prov()
909 		icon->width = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
910 		pos2 += 2;  in hs20_osu_add_prov()
911 		icon->height = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
912 		pos2 += 2;  in hs20_osu_add_prov()
913 		os_memcpy(icon->lang, pos2, 3);  in hs20_osu_add_prov()
914 		pos2 += 3;  in hs20_osu_add_prov()
916 		flen = *pos2++;  in hs20_osu_add_prov()
917 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
921 		os_memcpy(icon->icon_type, pos2, flen);  in hs20_osu_add_prov()
922 		pos2 += flen;  in hs20_osu_add_prov()
924 		if (pos - pos2 < 1) {  in hs20_osu_add_prov()
929 		flen = *pos2++;  in hs20_osu_add_prov()
930 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
935 		os_memcpy(icon->filename, pos2, flen);  in hs20_osu_add_prov()
936 		pos2 += flen;  in hs20_osu_add_prov()
967 	pos2 = pos;  in hs20_osu_add_prov()
971 	while (pos - pos2 >= 4 && prov->serv_desc_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
975 		descr_len = *pos2++;  in hs20_osu_add_prov()
976 		if (descr_len > pos - pos2 || descr_len < 3) {  in hs20_osu_add_prov()
982 		os_memcpy(f->lang, pos2, 3);  in hs20_osu_add_prov()
983 		os_memcpy(f->text, pos2 + 3, descr_len - 3);  in hs20_osu_add_prov()
984 		pos2 += descr_len;  in hs20_osu_add_prov()