Re: [PATCH v5 1/5] staging: rtl8723bs: fix heap buffer overflow in recvframe_defrag()

[Dan Carpenter]

On Fri, Apr 17, 2026 at 04:01:06AM +0100, Delene Tchio Romuald wrote:
> +		/* Verify the receiving buffer has enough space for the fragment */
> +		if (pnfhdr->len > pfhdr->rx_end - pfhdr->rx_tail)
> +			goto out_err;
>  
> -		/* memcpy */

I wasn't going to mention this, but since you're going to need to
resend anyway...  Yes, this comment is useless but don't delete it
as part of a security fix.  It's unrelated.

regards,
dan carpenter

>  		memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
>  
>  		recvframe_put(prframe, pnfhdr->len);