Re: [PATCH wireless-next v2] wifi: nxpwifi: validate variable IE lengths in beacon parser

[Jeff Chen]

On Sat, Sep 12, 2026 at 05:20:31 PM +0100, Aamir Ahmed wrote:
>  		case WLAN_EID_OPMODE_NOTIF:
> +			if (total_ie_len < sizeof(*bss_entry->oper_mode))
> +				return -EINVAL;
>  			bss_entry->oper_mode = (void *)current_ptr;
>  			bss_entry->oper_mode_offset =
>  				(u16)(current_ptr - bss_entry->beacon_buf);

Any reason to use total_ie_len here instead of element_len?
Since we only access oper_mode->oper_mode later, would
	element_len < sizeof(bss_entry->oper_mode->oper_mode)
also work here?

The current check looks fine to me.

Reviewed-by: Jeff Chen <jeff.chen_1@xxxxxxx>