[PATCH] staging: rtl8723bs: fix OOB write in HT_caps_handler()

[Alexandru Hossu <hossu.alexandru@gmail.com>]

Hi Greg,

Here is the fix.

Alexandru

---

The loop in HT_caps_handler() iterates up to pIE->length times, but
HT_cap[] is only 26 bytes. pIE->length comes from the HT Capability IE
in the association response and can be up to 255. This lets a rogue AP
write up to 229 bytes past the array using a bitwise AND into adjacent
struct fields.

Clamp the iteration count to the array size.

Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 4f41f88908d7..e271d1e395a5 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -935,7 +935,8 @@ void HT_caps_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)

 	pmlmeinfo->HT_caps_enable = 1;

-	for (i = 0; i < (pIE->length); i++) {
+	for (i = 0; i < min_t(unsigned int, pIE->length,
+			       sizeof(pmlmeinfo->HT_caps.u.HT_cap)); i++) {
 		if (i != 2) {
 			/* Commented by Albert 2010/07/12 */
 			/* Got the endian issue here. */