[PATCH 0/3] staging: rtl8723bs: fix OOB reads and heap overflow in IE parsing

[Alexandru Hossu <hossu.alexandru@gmail.com>]

This series fixes three related bugs in the rtl8723bs staging driver's
802.11 IE parsing code.  All three follow the same root cause: IE parsing
loops and IE handler functions do not validate that an IE's declared length
fits within the actual frame/buffer before operating on it.

Patch 1 and 2 fix OOB reads in three IE parsing loops
(update_beacon_info, issue_assocreq, join_cmd_hdl) that lack the two-guard
pattern already applied to OnAssocRsp() in a previous fix.  A malicious AP
sending a beacon or association response with a truncated final IE (e.g.,
only the element_id byte present, no length byte) causes the loop to read
pIE->length one byte past the end of the IE area.

Patch 3 fixes a one-byte heap buffer overflow in rtw_cfg80211_set_wpa_ie().
supplicant_ie is a 256-byte array in struct security_priv.  Because
wpa_ielen is taken directly from the IE length field (u8, 0-255), the copy:

    memcpy(supplicant_ie, pwpa, wpa_ielen + 2);

can write up to 257 bytes.  rtw_parse_wpa_ie()'s own length consistency
check silently passes because it casts the arithmetic to u8:
(u8)(257 - 2) == 255 == wpa_ielen.  The overflow is triggered via
NL80211_CMD_CONNECT with a crafted WPA IE of length 255; nl80211's
validate_ie_attr() accepts this as a well-formed (though oversized) IE.

Alexandru Hossu (3):
  staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
  staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
    join_cmd_hdl()
  staging: rtl8723bs: fix heap buffer overflow in
    rtw_cfg80211_set_wpa_ie()

 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c     | 8 ++++++++
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c    | 4 ++++
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++
 3 files changed, 20 insertions(+)

-- 
2.53.0