[PATCH v2 0/3] staging: rtl8723bs: fix multiple OOB reads in IE and frame parsing

[Muhammad Bilal]

v2 of the series fixing out-of-bounds read and buffer overflow bugs in
the rtl8723bs staging driver where length or offset fields from
untrusted wireless frames are used without validating that enough
bytes remain in the buffer.

Changes since v1:

 - Dropped patch 1/5 ("fix OOB read in rtw_get_wps_ie()") - did not
   apply.
 - Dropped patch 5/5 ("fix skb->len underflow in monitor TX path").

Muhammad Bilal (3):
  staging: rtl8723bs: fix OOB read / stack overflow in
    rtw_get_wps_attr()
  staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
  staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

 drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 +++++++
 drivers/staging/rtl8723bs/core/rtw_mlme.c      | 3 +++
 2 files changed, 10 insertions(+)

-- 
2.55.0