RE: [PATCH wireless] wifi: rtlwifi: fix OOB reads in IE parsing functions

[Ping-Ke Shih]

Tristan Madani <tristmd@xxxxxxxxx> wrote:

[...]

> @@ -2597,17 +2597,17 @@ static bool rtl_find_221_ie(struct ieee80211_hw *hw, u8 *data,
> 
>         pos = (u8 *)mgmt->u.beacon.variable;
>         end = data + len;
> -       while (pos < end) {
> -               if (pos[0] == 221) {
> +       while (pos + 2 <= end) {
> +               if (pos + 2 + pos[1] > end)
> +                       return false;
> +
> +               if (pos[0] == 221 && pos[1] >= 3) {

I think the 3 is because length of OUI is 3 used by rtl_chk_vendor_ouisub().
Please leave a comment for that reason.

>                         vendor_ie.length = pos[1];
>                         vendor_ie.octet = &pos[2];
>                         if (rtl_chk_vendor_ouisub(hw, vendor_ie))
>                                 return true;
>                 }
> 
> -               if (pos + 2 + pos[1] > end)
> -                       return false;
> -
>                 pos += 2 + pos[1];
>         }
>         return false;
> --
> 2.47.3