Re: [PATCH v2] wifi: mwifiex: validate HT/VHT capability and operation IE lengths

[Doruk (0sec)]

Yes, for bounds. cfg80211_find_ie() parses the IE stream and returns
NULL if an IE header plus its declared length does not fit in ies_len.
The len field is still on-air, attacker-controlled input, but it is
bounded by that parser.

The check is therefore only a minimum-size test before the fixed
cap_info read; it is not relying on len as a trustworthy value beyond
the parsed IE bounds. I’ll make that explicit in the v3 commit
message.

Thanks,
Doruk