contrib/wpa/src/wps/wps_attr_parse.c

   1 /*
   2  * Wi-Fi Protected Setup - attribute parsing
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "wps_defs.h"
  13 #include "wps_attr_parse.h"
  14
  15 #ifndef CONFIG_WPS_STRICT
  16 #define WPS_WORKAROUNDS
  17 #endif /* CONFIG_WPS_STRICT */
  18
  19
  20 static int wps_set_vendor_ext_wfa_subelem(struct wps_parse_attr *attr,
  21                                           u8 id, u8 len, const u8 *pos)
  22 {
  23         wpa_printf(MSG_EXCESSIVE, "WPS: WFA subelement id=%u len=%u",
  24                    id, len);
  25         switch (id) {
  26         case WFA_ELEM_VERSION2:
  27                 if (len != 1) {
  28                         wpa_printf(MSG_DEBUG, "WPS: Invalid Version2 length "
  29                                    "%u", len);
  30                         return -1;
  31                 }
  32                 attr->version2 = pos;
  33                 break;
  34         case WFA_ELEM_AUTHORIZEDMACS:
  35                 attr->authorized_macs = pos;
  36                 attr->authorized_macs_len = len;
  37                 break;
  38         case WFA_ELEM_NETWORK_KEY_SHAREABLE:
  39                 if (len != 1) {
  40                         wpa_printf(MSG_DEBUG, "WPS: Invalid Network Key "
  41                                    "Shareable length %u", len);
  42                         return -1;
  43                 }
  44                 attr->network_key_shareable = pos;
  45                 break;
  46         case WFA_ELEM_REQUEST_TO_ENROLL:
  47                 if (len != 1) {
  48                         wpa_printf(MSG_DEBUG, "WPS: Invalid Request to Enroll "
  49                                    "length %u", len);
  50                         return -1;
  51                 }
  52                 attr->request_to_enroll = pos;
  53                 break;
  54         case WFA_ELEM_SETTINGS_DELAY_TIME:
  55                 if (len != 1) {
  56                         wpa_printf(MSG_DEBUG, "WPS: Invalid Settings Delay "
  57                                    "Time length %u", len);
  58                         return -1;
  59                 }
  60                 attr->settings_delay_time = pos;
  61                 break;
  62         default:
  63                 wpa_printf(MSG_MSGDUMP, "WPS: Skipped unknown WFA Vendor "
  64                            "Extension subelement %u", id);
  65                 break;
  66         }
  67
  68         return 0;
  69 }
  70
  71
  72 static int wps_parse_vendor_ext_wfa(struct wps_parse_attr *attr, const u8 *pos,
  73                                     u16 len)
  74 {
  75         const u8 *end = pos + len;
  76         u8 id, elen;
  77
  78         while (pos + 2 < end) {
  79                 id = *pos++;
  80                 elen = *pos++;
  81                 if (pos + elen > end)
  82                         break;
  83                 if (wps_set_vendor_ext_wfa_subelem(attr, id, elen, pos) < 0)
  84                         return -1;
  85                 pos += elen;
  86         }
  87
  88         return 0;
  89 }
  90
  91
  92 static int wps_parse_vendor_ext(struct wps_parse_attr *attr, const u8 *pos,
  93                                 u16 len)
  94 {
  95         u32 vendor_id;
  96
  97         if (len < 3) {
  98                 wpa_printf(MSG_DEBUG, "WPS: Skip invalid Vendor Extension");
  99                 return 0;
 100         }
 101
 102         vendor_id = WPA_GET_BE24(pos);
 103         switch (vendor_id) {
 104         case WPS_VENDOR_ID_WFA:
 105                 return wps_parse_vendor_ext_wfa(attr, pos + 3, len - 3);
 106         }
 107
 108         /* Handle unknown vendor extensions */
 109
 110         wpa_printf(MSG_MSGDUMP, "WPS: Unknown Vendor Extension (Vendor ID %u)",
 111                    vendor_id);
 112
 113         if (len > WPS_MAX_VENDOR_EXT_LEN) {
 114                 wpa_printf(MSG_DEBUG, "WPS: Too long Vendor Extension (%u)",
 115                            len);
 116                 return -1;
 117         }
 118
 119         if (attr->num_vendor_ext >= MAX_WPS_PARSE_VENDOR_EXT) {
 120                 wpa_printf(MSG_DEBUG, "WPS: Skipped Vendor Extension "
 121                            "attribute (max %d vendor extensions)",
 122                            MAX_WPS_PARSE_VENDOR_EXT);
 123                 return -1;
 124         }
 125         attr->vendor_ext[attr->num_vendor_ext] = pos;
 126         attr->vendor_ext_len[attr->num_vendor_ext] = len;
 127         attr->num_vendor_ext++;
 128
 129         return 0;
 130 }
 131
 132
 133 static int wps_set_attr(struct wps_parse_attr *attr, u16 type,
 134                         const u8 *pos, u16 len)
 135 {
 136         switch (type) {
 137         case ATTR_VERSION:
 138                 if (len != 1) {
 139                         wpa_printf(MSG_DEBUG, "WPS: Invalid Version length %u",
 140                                    len);
 141                         return -1;
 142                 }
 143                 attr->version = pos;
 144                 break;
 145         case ATTR_MSG_TYPE:
 146                 if (len != 1) {
 147                         wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type "
 148                                    "length %u", len);
 149                         return -1;
 150                 }
 151                 attr->msg_type = pos;
 152                 break;
 153         case ATTR_ENROLLEE_NONCE:
 154                 if (len != WPS_NONCE_LEN) {
 155                         wpa_printf(MSG_DEBUG, "WPS: Invalid Enrollee Nonce "
 156                                    "length %u", len);
 157                         return -1;
 158                 }
 159                 attr->enrollee_nonce = pos;
 160                 break;
 161         case ATTR_REGISTRAR_NONCE:
 162                 if (len != WPS_NONCE_LEN) {
 163                         wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce "
 164                                    "length %u", len);
 165                         return -1;
 166                 }
 167                 attr->registrar_nonce = pos;
 168                 break;
 169         case ATTR_UUID_E:
 170                 if (len != WPS_UUID_LEN) {
 171                         wpa_printf(MSG_DEBUG, "WPS: Invalid UUID-E length %u",
 172                                    len);
 173                         return -1;
 174                 }
 175                 attr->uuid_e = pos;
 176                 break;
 177         case ATTR_UUID_R:
 178                 if (len != WPS_UUID_LEN) {
 179                         wpa_printf(MSG_DEBUG, "WPS: Invalid UUID-R length %u",
 180                                    len);
 181                         return -1;
 182                 }
 183                 attr->uuid_r = pos;
 184                 break;
 185         case ATTR_AUTH_TYPE_FLAGS:
 186                 if (len != 2) {
 187                         wpa_printf(MSG_DEBUG, "WPS: Invalid Authentication "
 188                                    "Type Flags length %u", len);
 189                         return -1;
 190                 }
 191                 attr->auth_type_flags = pos;
 192                 break;
 193         case ATTR_ENCR_TYPE_FLAGS:
 194                 if (len != 2) {
 195                         wpa_printf(MSG_DEBUG, "WPS: Invalid Encryption Type "
 196                                    "Flags length %u", len);
 197                         return -1;
 198                 }
 199                 attr->encr_type_flags = pos;
 200                 break;
 201         case ATTR_CONN_TYPE_FLAGS:
 202                 if (len != 1) {
 203                         wpa_printf(MSG_DEBUG, "WPS: Invalid Connection Type "
 204                                    "Flags length %u", len);
 205                         return -1;
 206                 }
 207                 attr->conn_type_flags = pos;
 208                 break;
 209         case ATTR_CONFIG_METHODS:
 210                 if (len != 2) {
 211                         wpa_printf(MSG_DEBUG, "WPS: Invalid Config Methods "
 212                                    "length %u", len);
 213                         return -1;
 214                 }
 215                 attr->config_methods = pos;
 216                 break;
 217         case ATTR_SELECTED_REGISTRAR_CONFIG_METHODS:
 218                 if (len != 2) {
 219                         wpa_printf(MSG_DEBUG, "WPS: Invalid Selected "
 220                                    "Registrar Config Methods length %u", len);
 221                         return -1;
 222                 }
 223                 attr->sel_reg_config_methods = pos;
 224                 break;
 225         case ATTR_PRIMARY_DEV_TYPE:
 226                 if (len != WPS_DEV_TYPE_LEN) {
 227                         wpa_printf(MSG_DEBUG, "WPS: Invalid Primary Device "
 228                                    "Type length %u", len);
 229                         return -1;
 230                 }
 231                 attr->primary_dev_type = pos;
 232                 break;
 233         case ATTR_RF_BANDS:
 234                 if (len != 1) {
 235                         wpa_printf(MSG_DEBUG, "WPS: Invalid RF Bands length "
 236                                    "%u", len);
 237                         return -1;
 238                 }
 239                 attr->rf_bands = pos;
 240                 break;
 241         case ATTR_ASSOC_STATE:
 242                 if (len != 2) {
 243                         wpa_printf(MSG_DEBUG, "WPS: Invalid Association State "
 244                                    "length %u", len);
 245                         return -1;
 246                 }
 247                 attr->assoc_state = pos;
 248                 break;
 249         case ATTR_CONFIG_ERROR:
 250                 if (len != 2) {
 251                         wpa_printf(MSG_DEBUG, "WPS: Invalid Configuration "
 252                                    "Error length %u", len);
 253                         return -1;
 254                 }
 255                 attr->config_error = pos;
 256                 break;
 257         case ATTR_DEV_PASSWORD_ID:
 258                 if (len != 2) {
 259                         wpa_printf(MSG_DEBUG, "WPS: Invalid Device Password "
 260                                    "ID length %u", len);
 261                         return -1;
 262                 }
 263                 attr->dev_password_id = pos;
 264                 break;
 265         case ATTR_OOB_DEVICE_PASSWORD:
 266                 if (len < WPS_OOB_PUBKEY_HASH_LEN + 2 +
 267                     WPS_OOB_DEVICE_PASSWORD_MIN_LEN ||
 268                     len > WPS_OOB_PUBKEY_HASH_LEN + 2 +
 269                     WPS_OOB_DEVICE_PASSWORD_LEN) {
 270                         wpa_printf(MSG_DEBUG, "WPS: Invalid OOB Device "
 271                                    "Password length %u", len);
 272                         return -1;
 273                 }
 274                 attr->oob_dev_password = pos;
 275                 attr->oob_dev_password_len = len;
 276                 break;
 277         case ATTR_OS_VERSION:
 278                 if (len != 4) {
 279                         wpa_printf(MSG_DEBUG, "WPS: Invalid OS Version length "
 280                                    "%u", len);
 281                         return -1;
 282                 }
 283                 attr->os_version = pos;
 284                 break;
 285         case ATTR_WPS_STATE:
 286                 if (len != 1) {
 287                         wpa_printf(MSG_DEBUG, "WPS: Invalid Wi-Fi Protected "
 288                                    "Setup State length %u", len);
 289                         return -1;
 290                 }
 291                 attr->wps_state = pos;
 292                 break;
 293         case ATTR_AUTHENTICATOR:
 294                 if (len != WPS_AUTHENTICATOR_LEN) {
 295                         wpa_printf(MSG_DEBUG, "WPS: Invalid Authenticator "
 296                                    "length %u", len);
 297                         return -1;
 298                 }
 299                 attr->authenticator = pos;
 300                 break;
 301         case ATTR_R_HASH1:
 302                 if (len != WPS_HASH_LEN) {
 303                         wpa_printf(MSG_DEBUG, "WPS: Invalid R-Hash1 length %u",
 304                                    len);
 305                         return -1;
 306                 }
 307                 attr->r_hash1 = pos;
 308                 break;
 309         case ATTR_R_HASH2:
 310                 if (len != WPS_HASH_LEN) {
 311                         wpa_printf(MSG_DEBUG, "WPS: Invalid R-Hash2 length %u",
 312                                    len);
 313                         return -1;
 314                 }
 315                 attr->r_hash2 = pos;
 316                 break;
 317         case ATTR_E_HASH1:
 318                 if (len != WPS_HASH_LEN) {
 319                         wpa_printf(MSG_DEBUG, "WPS: Invalid E-Hash1 length %u",
 320                                    len);
 321                         return -1;
 322                 }
 323                 attr->e_hash1 = pos;
 324                 break;
 325         case ATTR_E_HASH2:
 326                 if (len != WPS_HASH_LEN) {
 327                         wpa_printf(MSG_DEBUG, "WPS: Invalid E-Hash2 length %u",
 328                                    len);
 329                         return -1;
 330                 }
 331                 attr->e_hash2 = pos;
 332                 break;
 333         case ATTR_R_SNONCE1:
 334                 if (len != WPS_SECRET_NONCE_LEN) {
 335                         wpa_printf(MSG_DEBUG, "WPS: Invalid R-SNonce1 length "
 336                                    "%u", len);
 337                         return -1;
 338                 }
 339                 attr->r_snonce1 = pos;
 340                 break;
 341         case ATTR_R_SNONCE2:
 342                 if (len != WPS_SECRET_NONCE_LEN) {
 343                         wpa_printf(MSG_DEBUG, "WPS: Invalid R-SNonce2 length "
 344                                    "%u", len);
 345                         return -1;
 346                 }
 347                 attr->r_snonce2 = pos;
 348                 break;
 349         case ATTR_E_SNONCE1:
 350                 if (len != WPS_SECRET_NONCE_LEN) {
 351                         wpa_printf(MSG_DEBUG, "WPS: Invalid E-SNonce1 length "
 352                                    "%u", len);
 353                         return -1;
 354                 }
 355                 attr->e_snonce1 = pos;
 356                 break;
 357         case ATTR_E_SNONCE2:
 358                 if (len != WPS_SECRET_NONCE_LEN) {
 359                         wpa_printf(MSG_DEBUG, "WPS: Invalid E-SNonce2 length "
 360                                    "%u", len);
 361                         return -1;
 362                 }
 363                 attr->e_snonce2 = pos;
 364                 break;
 365         case ATTR_KEY_WRAP_AUTH:
 366                 if (len != WPS_KWA_LEN) {
 367                         wpa_printf(MSG_DEBUG, "WPS: Invalid Key Wrap "
 368                                    "Authenticator length %u", len);
 369                         return -1;
 370                 }
 371                 attr->key_wrap_auth = pos;
 372                 break;
 373         case ATTR_AUTH_TYPE:
 374                 if (len != 2) {
 375                         wpa_printf(MSG_DEBUG, "WPS: Invalid Authentication "
 376                                    "Type length %u", len);
 377                         return -1;
 378                 }
 379                 attr->auth_type = pos;
 380                 break;
 381         case ATTR_ENCR_TYPE:
 382                 if (len != 2) {
 383                         wpa_printf(MSG_DEBUG, "WPS: Invalid Encryption "
 384                                    "Type length %u", len);
 385                         return -1;
 386                 }
 387                 attr->encr_type = pos;
 388                 break;
 389         case ATTR_NETWORK_INDEX:
 390                 if (len != 1) {
 391                         wpa_printf(MSG_DEBUG, "WPS: Invalid Network Index "
 392                                    "length %u", len);
 393                         return -1;
 394                 }
 395                 attr->network_idx = pos;
 396                 break;
 397         case ATTR_NETWORK_KEY_INDEX:
 398                 if (len != 1) {
 399                         wpa_printf(MSG_DEBUG, "WPS: Invalid Network Key Index "
 400                                    "length %u", len);
 401                         return -1;
 402                 }
 403                 attr->network_key_idx = pos;
 404                 break;
 405         case ATTR_MAC_ADDR:
 406                 if (len != ETH_ALEN) {
 407                         wpa_printf(MSG_DEBUG, "WPS: Invalid MAC Address "
 408                                    "length %u", len);
 409                         return -1;
 410                 }
 411                 attr->mac_addr = pos;
 412                 break;
 413         case ATTR_KEY_PROVIDED_AUTO:
 414                 if (len != 1) {
 415                         wpa_printf(MSG_DEBUG, "WPS: Invalid Key Provided "
 416                                    "Automatically length %u", len);
 417                         return -1;
 418                 }
 419                 attr->key_prov_auto = pos;
 420                 break;
 421         case ATTR_802_1X_ENABLED:
 422                 if (len != 1) {
 423                         wpa_printf(MSG_DEBUG, "WPS: Invalid 802.1X Enabled "
 424                                    "length %u", len);
 425                         return -1;
 426                 }
 427                 attr->dot1x_enabled = pos;
 428                 break;
 429         case ATTR_SELECTED_REGISTRAR:
 430                 if (len != 1) {
 431                         wpa_printf(MSG_DEBUG, "WPS: Invalid Selected Registrar"
 432                                    " length %u", len);
 433                         return -1;
 434                 }
 435                 attr->selected_registrar = pos;
 436                 break;
 437         case ATTR_REQUEST_TYPE:
 438                 if (len != 1) {
 439                         wpa_printf(MSG_DEBUG, "WPS: Invalid Request Type "
 440                                    "length %u", len);
 441                         return -1;
 442                 }
 443                 attr->request_type = pos;
 444                 break;
 445         case ATTR_RESPONSE_TYPE:
 446                 if (len != 1) {
 447                         wpa_printf(MSG_DEBUG, "WPS: Invalid Response Type "
 448                                    "length %u", len);
 449                         return -1;
 450                 }
 451                 attr->response_type = pos;
 452                 break;
 453         case ATTR_MANUFACTURER:
 454                 attr->manufacturer = pos;
 455                 attr->manufacturer_len = len;
 456                 break;
 457         case ATTR_MODEL_NAME:
 458                 attr->model_name = pos;
 459                 attr->model_name_len = len;
 460                 break;
 461         case ATTR_MODEL_NUMBER:
 462                 attr->model_number = pos;
 463                 attr->model_number_len = len;
 464                 break;
 465         case ATTR_SERIAL_NUMBER:
 466                 attr->serial_number = pos;
 467                 attr->serial_number_len = len;
 468                 break;
 469         case ATTR_DEV_NAME:
 470                 attr->dev_name = pos;
 471                 attr->dev_name_len = len;
 472                 break;
 473         case ATTR_PUBLIC_KEY:
 474                 attr->public_key = pos;
 475                 attr->public_key_len = len;
 476                 break;
 477         case ATTR_ENCR_SETTINGS:
 478                 attr->encr_settings = pos;
 479                 attr->encr_settings_len = len;
 480                 break;
 481         case ATTR_CRED:
 482                 if (attr->num_cred >= MAX_CRED_COUNT) {
 483                         wpa_printf(MSG_DEBUG, "WPS: Skipped Credential "
 484                                    "attribute (max %d credentials)",
 485                                    MAX_CRED_COUNT);
 486                         break;
 487                 }
 488                 attr->cred[attr->num_cred] = pos;
 489                 attr->cred_len[attr->num_cred] = len;
 490                 attr->num_cred++;
 491                 break;
 492         case ATTR_SSID:
 493                 attr->ssid = pos;
 494                 attr->ssid_len = len;
 495                 break;
 496         case ATTR_NETWORK_KEY:
 497                 attr->network_key = pos;
 498                 attr->network_key_len = len;
 499                 break;
 500         case ATTR_EAP_TYPE:
 501                 attr->eap_type = pos;
 502                 attr->eap_type_len = len;
 503                 break;
 504         case ATTR_EAP_IDENTITY:
 505                 attr->eap_identity = pos;
 506                 attr->eap_identity_len = len;
 507                 break;
 508         case ATTR_AP_SETUP_LOCKED:
 509                 if (len != 1) {
 510                         wpa_printf(MSG_DEBUG, "WPS: Invalid AP Setup Locked "
 511                                    "length %u", len);
 512                         return -1;
 513                 }
 514                 attr->ap_setup_locked = pos;
 515                 break;
 516         case ATTR_REQUESTED_DEV_TYPE:
 517                 if (len != WPS_DEV_TYPE_LEN) {
 518                         wpa_printf(MSG_DEBUG, "WPS: Invalid Requested Device "
 519                                    "Type length %u", len);
 520                         return -1;
 521                 }
 522                 if (attr->num_req_dev_type >= MAX_REQ_DEV_TYPE_COUNT) {
 523                         wpa_printf(MSG_DEBUG, "WPS: Skipped Requested Device "
 524                                    "Type attribute (max %u types)",
 525                                    MAX_REQ_DEV_TYPE_COUNT);
 526                         break;
 527                 }
 528                 attr->req_dev_type[attr->num_req_dev_type] = pos;
 529                 attr->num_req_dev_type++;
 530                 break;
 531         case ATTR_SECONDARY_DEV_TYPE_LIST:
 532                 if (len > WPS_SEC_DEV_TYPE_MAX_LEN ||
 533                     (len % WPS_DEV_TYPE_LEN) > 0) {
 534                         wpa_printf(MSG_DEBUG, "WPS: Invalid Secondary Device "
 535                                    "Type length %u", len);
 536                         return -1;
 537                 }
 538                 attr->sec_dev_type_list = pos;
 539                 attr->sec_dev_type_list_len = len;
 540                 break;
 541         case ATTR_VENDOR_EXT:
 542                 if (wps_parse_vendor_ext(attr, pos, len) < 0)
 543                         return -1;
 544                 break;
 545         case ATTR_AP_CHANNEL:
 546                 if (len != 2) {
 547                         wpa_printf(MSG_DEBUG, "WPS: Invalid AP Channel "
 548                                    "length %u", len);
 549                         return -1;
 550                 }
 551                 attr->ap_channel = pos;
 552                 break;
 553         default:
 554                 wpa_printf(MSG_DEBUG, "WPS: Unsupported attribute type 0x%x "
 555                            "len=%u", type, len);
 556                 break;
 557         }
 558
 559         return 0;
 560 }
 561
 562
 563 int wps_parse_msg(const struct wpabuf *msg, struct wps_parse_attr *attr)
 564 {
 565         const u8 *pos, *end;
 566         u16 type, len;
 567 #ifdef WPS_WORKAROUNDS
 568         u16 prev_type = 0;
 569 #endif /* WPS_WORKAROUNDS */
 570
 571         os_memset(attr, 0, sizeof(*attr));
 572         pos = wpabuf_head(msg);
 573         end = pos + wpabuf_len(msg);
 574
 575         while (pos < end) {
 576                 if (end - pos < 4) {
 577                         wpa_printf(MSG_DEBUG, "WPS: Invalid message - "
 578                                    "%lu bytes remaining",
 579                                    (unsigned long) (end - pos));
 580                         return -1;
 581                 }
 582
 583                 type = WPA_GET_BE16(pos);
 584                 pos += 2;
 585                 len = WPA_GET_BE16(pos);
 586                 pos += 2;
 587                 wpa_printf(MSG_EXCESSIVE, "WPS: attr type=0x%x len=%u",
 588                            type, len);
 589                 if (len > end - pos) {
 590                         wpa_printf(MSG_DEBUG, "WPS: Attribute overflow");
 591                         wpa_hexdump_buf(MSG_MSGDUMP, "WPS: Message data", msg);
 592 #ifdef WPS_WORKAROUNDS
 593                         /*
 594                          * Some deployed APs seem to have a bug in encoding of
 595                          * Network Key attribute in the Credential attribute
 596                          * where they add an extra octet after the Network Key
 597                          * attribute at least when open network is being
 598                          * provisioned.
 599                          */
 600                         if ((type & 0xff00) != 0x1000 &&
 601                             prev_type == ATTR_NETWORK_KEY) {
 602                                 wpa_printf(MSG_DEBUG, "WPS: Workaround - try "
 603                                            "to skip unexpected octet after "
 604                                            "Network Key");
 605                                 pos -= 3;
 606                                 continue;
 607                         }
 608 #endif /* WPS_WORKAROUNDS */
 609                         return -1;
 610                 }
 611
 612 #ifdef WPS_WORKAROUNDS
 613                 if (type == 0 && len == 0) {
 614                         /*
 615                          * Mac OS X 10.6 seems to be adding 0x00 padding to the
 616                          * end of M1. Skip those to avoid interop issues.
 617                          */
 618                         int i;
 619                         for (i = 0; i < end - pos; i++) {
 620                                 if (pos[i])
 621                                         break;
 622                         }
 623                         if (i == end - pos) {
 624                                 wpa_printf(MSG_DEBUG, "WPS: Workaround - skip "
 625                                            "unexpected message padding");
 626                                 break;
 627                         }
 628                 }
 629 #endif /* WPS_WORKAROUNDS */
 630
 631                 if (wps_set_attr(attr, type, pos, len) < 0)
 632                         return -1;
 633
 634 #ifdef WPS_WORKAROUNDS
 635                 prev_type = type;
 636 #endif /* WPS_WORKAROUNDS */
 637                 pos += len;
 638         }
 639
 640         return 0;
 641 }