From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:15:45 +0000 (+0200) Subject: fix up queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie... X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c8612c864e8122494f9e38f79cd21d5fb9637597;p=thirdparty%2Fkernel%2Fstable-queue.git fix up queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch --- diff --git a/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch b/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch index f779f55fe0..8206195358 100644 --- a/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch +++ b/queue-5.15/staging-rtl8723bs-fix-oob-reads-in-rtw_get_sec_ie-rtw_get_wapi_ie-and-rtw_get_wps_attr.patch @@ -38,8 +38,8 @@ Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- - drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) + drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) --- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c +++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c @@ -83,12 +83,13 @@ Signed-off-by: Greg Kroah-Hartman if ((wps_ie[0] != WLAN_EID_VENDOR_SPECIFIC) || (memcmp(wps_ie + 2, wps_oui, 4))) { return attr_ptr; -@@ -732,6 +745,8 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wp +@@ -736,6 +749,9 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wp + u16 attr_data_len = get_unaligned_be16(attr_ptr + 2); + u16 attr_len = attr_data_len + 4; - while (attr_ptr - wps_ie < wps_ielen) { - /* 4 = 2(Attribute ID) + 2(Length) */ + if (attr_ptr + 4 > wps_ie + wps_ielen) + break; - u16 attr_id = get_unaligned_be16(attr_ptr); - u16 attr_data_len = get_unaligned_be16(attr_ptr + 2); - u16 attr_len = attr_data_len + 4; ++ + if (attr_id == target_attr_id) { + target_attr_ptr = attr_ptr; +