Re: [PATCH] wifi: mwifiex: validate rate scope TLV length

[Francesco Dolcini]

On Mon, Jul 06, 2026 at 05:13:46PM +0800, Pengpeng Hou wrote:
> From: Pengpeng <pengpeng@xxxxxxxxxxx>
> 
> mwifiex_ret_tx_rate_cfg() verifies that a TLV stays within the command
> response, then parses RATE_SCOPE as struct mwifiex_rate_scope. The
> type-specific parser also needs to prove that the declared TLV payload
> covers the bitmap fields that it reads.
> 
> Check the RATE_SCOPE payload length before copying the legacy bitmaps,
> and require the VHT bitmap area only for firmware API version 15 where
> it is consumed.
> 
> Signed-off-by: Pengpeng <pengpeng@xxxxxxxxxxx>

Is this change tested? On which device? How?

Francesco