averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()

Browse Source 
commit f0109b9d3e upstream.

Just like in commit 154828bf95 ("staging: rtl8723bs: fix out-of-bounds
read in rtw_get_ie() parser"), we don't trust the data in the frame so
we should check the length better before acting on it

Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Tested-by: Navaneeth K <knavaneeth786@gmail.com>
Reviewed-by: Navaneeth K <knavaneeth786@gmail.com>
Link: https://patch.msgid.link/2026022336-arrange-footwork-6e54@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Greg Kroah-Hartman
2026-03-25 11:05:52 +01:00
parent 627cf4d1f0
commit 740bca8bbd
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+10 -5
View File
@@ -186,20 +186,25 @@ u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, u
cnt = 0;
while (cnt < in_len) {
while (cnt + 2 <= in_len) {
u8 ie_len = in_ie[cnt + 1];
if (cnt + 2 + ie_len > in_len)
break;
if (eid == in_ie[cnt]
&& (!oui || !memcmp(&in_ie[cnt+2], oui, oui_len))) {
&& (!oui || (ie_len >= oui_len && !memcmp(&in_ie[cnt + 2], oui, oui_len)))) {
target_ie = &in_ie[cnt];
if (ie)
memcpy(ie, &in_ie[cnt], in_ie[cnt+1]+2);
memcpy(ie, &in_ie[cnt], ie_len + 2);
if (ielen)
*ielen = in_ie[cnt+1]+2;
*ielen = ie_len + 2;
break;
}
cnt += in_ie[cnt+1]+2; /* goto next */
cnt += ie_len + 2; /* goto next */
}
return target_ie;