fix up queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie...

diff --git a/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch b/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch
index f779f55fe06e362f2db16cb3e7e9d340e6932173..820619535809820a928c68309fe4e98007da2151 100644 (file)
--- a/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch
+++ b/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch
@@ -38,8 +38,8 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
- drivers/staging/rtl8723bs/core/rtw_ieee80211.c |   15 +++++++++++++++
- 1 file changed, 15 insertions(+)
+ drivers/staging/rtl8723bs/core/rtw_ieee80211.c |   16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
 
 --- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
 +++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -83,12 +83,13 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
        if ((wps_ie[0] != WLAN_EID_VENDOR_SPECIFIC) ||
                (memcmp(wps_ie + 2, wps_oui, 4))) {
                return attr_ptr;
-@@ -732,6 +745,8 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wp
+@@ -736,6 +749,9 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wp
+               u16 attr_data_len = get_unaligned_be16(attr_ptr + 2);
+               u16 attr_len = attr_data_len + 4;
  
-       while (attr_ptr - wps_ie < wps_ielen) {
-               /*  4 = 2(Attribute ID) + 2(Length) */
 +              if (attr_ptr + 4 > wps_ie + wps_ielen)
 +                      break;
-               u16 attr_id = get_unaligned_be16(attr_ptr);
-               u16 attr_data_len = get_unaligned_be16(attr_ptr + 2);
-               u16 attr_len = attr_data_len + 4;
++
+               if (attr_id == target_attr_id) {
+                       target_attr_ptr = attr_ptr;
+