Re: [PATCH v5 1/5] staging: rtl8723bs: fix heap buffer overflow in recvframe_defrag()

Dan Carpenter
2026-04-17T05:31:27Z

On Fri, Apr 17, 2026 at 04:01:06AM +0100, Delene Tchio Romuald wrote:
> + /* Verify the receiving buffer has enough space for the fragment */
> + if (pnfhdr->len > pfhdr->rx_end - pfhdr->rx_tail)
> + goto out_err;
>
> - /* memcpy */

I wasn't going to mention this, but since you're going to need to
resend anyway... Yes, this comment is useless but don't delete it
as part of a security fix. It's unrelated.

regards,
dan carpenter

> memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
>
> recvframe_put(prframe, pnfhdr->len);