mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 10:09:10 +02:00
0e95ff792a
rtw_get_wps_ie() iterates over IE data from network frames without
validating that the IE header and payload fit within the remaining
buffer before reading them. Specifically:
- in_ie[cnt + 1] is read without checking cnt + 1 < in_len
- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
- in_ie[cnt + 1] is used as length without verifying payload fits
Add bounds checks at the top of the loop body to break early if fewer
than 2 bytes remain for the IE header, or if the declared payload
extends past the end of the buffer. Also require at least 4 bytes of
payload before comparing the WPS OUI.
Fixes:
|
||
|---|---|---|
| .. | ||
| axis-fifo | ||
| fbtft | ||
| greybus | ||
| iio | ||
| media | ||
| most | ||
| nvec | ||
| octeon | ||
| rtl8723bs | ||
| sm750fb | ||
| vc04_services | ||
| vme_user | ||
| Kconfig | ||
| Makefile | ||