Messages in this thread Patch in this message |  | | From | Delene Tchio Romuald <> | | Subject | [PATCH v3 5/5] staging: rtl8723bs: fix negative length in WEP decryption | | Date | Sun, 5 Apr 2026 11:15:48 +0100 |
| |
In rtw_wep_decrypt(), length is declared as signed int and computed as:
length = len - hdrlen - iv_len;
If the received frame is shorter than the combined header and IV lengths, length becomes negative. It is then passed to arc4_crypt() which takes a u32 parameter, causing the negative value to be implicitly cast to a very large unsigned value (e.g., -8 becomes 4294967288). This results in a massive out-of-bounds read and write on the heap via arc4_crypt(), and a similar overflow at the subsequent crc32_le() call using length - 4.
Add a minimum frame length check before the subtraction to ensure length is always positive.
Found by reviewing memory operations in the driver. Not tested on hardware.
Signed-off-by: Delene Tchio Romuald <delenetchior1@gmail.com> --- v3: - Rebased on staging-next - Sent as numbered series with proper Cc from get_maintainer.pl
drivers/staging/rtl8723bs/core/rtw_security.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/staging/rtl8723bs/core/rtw_security.c b/drivers/staging/rtl8723bs/core/rtw_security.c index a00504ff29109..f3bc2240749a4 100644 --- a/drivers/staging/rtl8723bs/core/rtw_security.c +++ b/drivers/staging/rtl8723bs/core/rtw_security.c @@ -113,6 +113,12 @@ void rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe) memcpy(&wepkey[0], iv, 3); /* memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0], keylength); */ memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[keyindex].skey[0], keylength); + + /* Ensure the frame is long enough for WEP decryption */ + if (((union recv_frame *)precvframe)->u.hdr.len <= + prxattrib->hdrlen + prxattrib->iv_len) + return; + length = ((union recv_frame *)precvframe)->u.hdr.len - prxattrib->hdrlen - prxattrib->iv_len; payload = pframe + prxattrib->iv_len + prxattrib->hdrlen; -- 2.43.0
|  |