Re: [PATCH] staging: rtl8723bs: fix OOB write in HT_caps_handler()

[Dan Carpenter <error27@gmail.com>]

On Fri, May 15, 2026 at 03:42:03AM -0700, Alexandru Hossu wrote:
> Hi Greg,
> 
> Here is the fix.
> 
> Alexandru
> 
> ---
> 
> The loop in HT_caps_handler() iterates up to pIE->length times, but
> HT_cap[] is only 26 bytes. pIE->length comes from the HT Capability IE
> in the association response and can be up to 255. This lets a rogue AP
> write up to 229 bytes past the array using a bitwise AND into adjacent
> struct fields.
> 
> Clamp the iteration count to the array size.
> 
> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
> ---

This isn't how you send a patch.  Try applying your email with:
`cat raw_email.txt | git am` and use git log to see the problem.

>  drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
> index 4f41f88908d7..e271d1e395a5 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
> @@ -935,7 +935,8 @@ void HT_caps_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
> 
>  	pmlmeinfo->HT_caps_enable = 1;
> 
> -	for (i = 0; i < (pIE->length); i++) {
> +	for (i = 0; i < min_t(unsigned int, pIE->length,
> +			       sizeof(pmlmeinfo->HT_caps.u.HT_cap)); i++) {

Just use min() instead of min_t().  They're both unsigned.

regards,
dan carpenter