Re: [PATCH v2 0/3] staging: rtl8723bs: fix multiple OOB reads in IE and frame parsing

[Muhammad Bilal]

ping.

On Tue, Jul 28, 2026 at 5:55 PM Muhammad Bilal <meatuni001@xxxxxxxxx> wrote:
>
> v2 of the series fixing out-of-bounds read and buffer overflow bugs in
> the rtl8723bs staging driver where length or offset fields from
> untrusted wireless frames are used without validating that enough
> bytes remain in the buffer.
>
> Changes since v1:
>
>  - Dropped patch 1/5 ("fix OOB read in rtw_get_wps_ie()") - did not
>    apply.
>  - Dropped patch 5/5 ("fix skb->len underflow in monitor TX path").
>
> Muhammad Bilal (3):
>   staging: rtl8723bs: fix OOB read / stack overflow in
>     rtw_get_wps_attr()
>   staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
>   staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
>
>  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 +++++++
>  drivers/staging/rtl8723bs/core/rtw_mlme.c      | 3 +++
>  2 files changed, 10 insertions(+)
>
> --
> 2.55.0
>