[PATCH 1/3] staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

[Alexandru Hossu <hossu.alexandru@gmail.com>]

The IE parsing loop in update_beacon_info() advances by (pIE->length + 2)
each iteration but only guards on i < len.  When a malicious AP sends a
beacon whose last IE has only one byte remaining in the frame (the
element_id byte lands at len-1), the loop reads pIE->length from one byte
past the IE area.

Additionally, even when the header bytes are in bounds, pIE->length itself
can extend the data window beyond len, silently passing a truncated IE to
handler functions such as bwmode_update_check() and ERP_IE_handler().

The parallel fix already applied to OnAssocRsp() uses two guards:
  1. Break if fewer than sizeof(*pIE) bytes remain (can't read the header).
  2. Break if the IE's declared data extends past the frame boundary.

Apply the same pattern to update_beacon_info().

Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index b75e7f4f8d27..551d7200d3a9 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1292,7 +1292,11 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
 	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
 
 	for (i = 0; i < len;) {
+		if (i + sizeof(*pIE) > len)
+			break;
 		pIE = (struct ndis_80211_var_ie *)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+		if (i + sizeof(*pIE) + pIE->length > len)
+			break;
 
 		switch (pIE->element_id) {
 		case WLAN_EID_VENDOR_SPECIFIC:
-- 
2.53.0