staging: rtl8723bs: OOB write in HT_caps_handler() via attacker-controlled IE length

[Alexandru Hossu <hossu.alexandru@gmail.com>]

Hi,

I found an out-of-bounds write in HT_caps_handler() in
drivers/staging/rtl8723bs/core/rtw_wlan_util.c.

At line 938-942:

    for (i = 0; i < (pIE->length); i++) {
        if (i != 2) {
            pmlmeinfo->HT_caps.u.HT_cap[i] &= (pIE->data[i]);

HT_cap[] is 26 bytes (wifi.h:349). pIE->length comes from the
WLAN_EID_HT_CAPABILITY IE in an association response and can be up to 255.
The loop writes up to 229 bytes past the end of the array.

A rogue access point triggers this by sending an HT Capability IE with
length > 26 in the association response. No authentication is needed.

The write is AND-only so it can only clear bits in adjacent struct fields
(HT_info, wlan_bssid_ex). This causes state corruption and can crash the
driver. The RTL8723BS chip is in a large number of cheap laptops and IoT
devices.

Suggested fix:

    u8 ht_cap_len = min_t(u8, pIE->length,
                          sizeof(pmlmeinfo->HT_caps.u.HT_cap));
    for (i = 0; i < ht_cap_len; i++) {

Tested on linux-next commit e98d21c170b0 (2026-05-08).

Alexandru