[PATCH v3 0/5] staging: rtl8723bs: fix multiple missing bounds checks

[Delene Tchio Romuald]

This series fixes five missing bounds checks in the rtl8723bs driver
that can be triggered by malformed WiFi frames. Each patch addresses
one function and is independent of the others, but they are sent as
a series since they all modify the same driver.

All patches are based on staging-next, pass checkpatch with no errors
or warnings, and compile cleanly. Found by reviewing the 40 memcpy
calls in rtw_recv.c and tracing buffer pointer manipulation through
the inline helpers in rtw_recv.h. Not tested on hardware.

Changes since v2:
 - Rebased on staging-next
 - Sent as a numbered series instead of individual patches
 - Added proper Cc list from get_maintainer.pl

Delene Tchio Romuald (5):
  staging: rtl8723bs: fix heap buffer overflow in recvframe_defrag()
  staging: rtl8723bs: fix integer underflow in TKIP MIC verification
  staging: rtl8723bs: fix out-of-bounds read in portctrl()
  staging: rtl8723bs: fix out-of-bounds reads in IE parsing functions
  staging: rtl8723bs: fix negative length in WEP decryption

 .../staging/rtl8723bs/core/rtw_ieee80211.c    | 15 +++++--
 drivers/staging/rtl8723bs/core/rtw_recv.c     | 43 ++++++++++++++-----
 drivers/staging/rtl8723bs/core/rtw_security.c |  6 +++
 3 files changed, 50 insertions(+), 14 deletions(-)

-- 
2.43.0