[PATCH v2 2/2] staging: rtl8723bs: bound the SSID element length before copying it

[Ali Ahmet Memis]

rtw_check_beacon_data() copies the SSID element straight into a fixed
32 byte array:

	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_SSID, &ie_len, ...);
	if (p && ie_len > 0) {
		memset(&pbss_network->ssid, 0, sizeof(struct ndis_802_11_ssid));
		memcpy(pbss_network->ssid.ssid, (p + 2), ie_len);

rtw_get_ie() writes the raw element length byte to *len and only limits
it against the end of the IE buffer:

	tmp = *(p + 1);
	if (i + 2 + tmp > limit)
		break;
	if (*p == index) {
		*len = tmp;

so ie_len can be up to 255, while the destination is

	struct ndis_802_11_ssid {
		u32  ssid_length;
		u8   ssid[32];
	};

and the only length check the function does beforehand is len <= MAX_IE_SZ
on the whole buffer. An SSID element longer than 32 bytes therefore
overruns ssid[] and the members of struct wlan_bssid_ex that follow it in
pmlmepriv->cur_network.network.

The beacon comes from cfg80211 start_ap and change_beacon, so it needs
CAP_NET_ADMIN and a beacon that hostapd would not normally build, but
nothing stops it. Skip the copy when the element does not fit, which is
what already happens when the element is absent.

Signed-off-by: Ali Ahmet Memis <ali@xxxxxxxxxxxxxx>
---
 drivers/staging/rtl8723bs/core/rtw_ap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c
index 065850a9e894..62f420636485 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -802,7 +802,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
 		       WLAN_EID_SSID,
 		       &ie_len,
 		       (pbss_network->ie_length - _BEACON_IE_OFFSET_));
-	if (p && ie_len > 0) {
+	if (p && ie_len > 0 && ie_len <= sizeof(pbss_network->ssid.ssid)) {
 		memset(&pbss_network->ssid, 0, sizeof(struct ndis_802_11_ssid));
 		memcpy(pbss_network->ssid.ssid, (p + 2), ie_len);
 		pbss_network->ssid.ssid_length = ie_len;
-- 
2.55.0