756 	const u8 *pos2;  in hs20_osu_add_prov()  local
786 	pos2 = pos;  in hs20_osu_add_prov()
790 	while (pos - pos2 >= 4 && prov->friendly_name_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
792 		if (1 + pos2[0] > pos - pos2 || pos2[0] < 3) {  in hs20_osu_add_prov()
797 		os_memcpy(f->lang, pos2 + 1, 3);  in hs20_osu_add_prov()
798 		os_memcpy(f->text, pos2 + 1 + 3, pos2[0] - 3);  in hs20_osu_add_prov()
799 		pos2 += 1 + pos2[0];  in hs20_osu_add_prov()
829 	pos2 = pos + 1;  in hs20_osu_add_prov()
831 	while (pos2 < pos) {  in hs20_osu_add_prov()
832 		if (*pos2 < 32)  in hs20_osu_add_prov()
833 			prov->osu_methods |= BIT(*pos2);  in hs20_osu_add_prov()
834 		pos2++;  in hs20_osu_add_prov()
850 	pos2 = pos;  in hs20_osu_add_prov()
854 	while (pos2 < pos) {  in hs20_osu_add_prov()
858 		if (2 + 2 + 3 + 1 + 1 > pos - pos2) {  in hs20_osu_add_prov()
863 		icon->width = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
864 		pos2 += 2;  in hs20_osu_add_prov()
865 		icon->height = WPA_GET_LE16(pos2);  in hs20_osu_add_prov()
866 		pos2 += 2;  in hs20_osu_add_prov()
867 		os_memcpy(icon->lang, pos2, 3);  in hs20_osu_add_prov()
868 		pos2 += 3;  in hs20_osu_add_prov()
870 		flen = *pos2++;  in hs20_osu_add_prov()
871 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
875 		os_memcpy(icon->icon_type, pos2, flen);  in hs20_osu_add_prov()
876 		pos2 += flen;  in hs20_osu_add_prov()
878 		if (pos - pos2 < 1) {  in hs20_osu_add_prov()
883 		flen = *pos2++;  in hs20_osu_add_prov()
884 		if (flen > pos - pos2) {  in hs20_osu_add_prov()
889 		os_memcpy(icon->filename, pos2, flen);  in hs20_osu_add_prov()
890 		pos2 += flen;  in hs20_osu_add_prov()
921 	pos2 = pos;  in hs20_osu_add_prov()
925 	while (pos - pos2 >= 4 && prov->serv_desc_count < OSU_MAX_ITEMS) {  in hs20_osu_add_prov()
929 		descr_len = *pos2++;  in hs20_osu_add_prov()
930 		if (descr_len > pos - pos2 || descr_len < 3) {  in hs20_osu_add_prov()
936 		os_memcpy(f->lang, pos2, 3);  in hs20_osu_add_prov()
937 		os_memcpy(f->text, pos2 + 3, descr_len - 3);  in hs20_osu_add_prov()
938 		pos2 += descr_len;  in hs20_osu_add_prov()