[PATCH] wifi: mm81x: check bytes_remaining before reading delimiter

[PATCH] wifi: mm81x: check bytes_remaining before reading delimiter

[Muhammad Bilal]

mm81x_yaps_hw_read_pkts() reads a full 4-byte delimiter and then
subtracts sizeof(delim) from bytes_remaining on every loop iteration,
guarded only by "bytes_remaining > 0". If 1-3 bytes are left in the
window, this reads past the end of the valid data and then subtracts
4 from a value smaller than 4, driving bytes_remaining negative.

A negative bytes_remaining then reaches the total_len > bytes_remaining
branch, where "bytes_remaining" is passed to memcpy() as the copy
length. Implicitly converted to size_t, a negative int becomes a
huge value, turning that memcpy() into a massive out-of-bounds copy.

Bail out of the split loop once fewer than sizeof(delim) bytes remain,
the same way the existing "end of stream" check bails on a zero
delimiter.

Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/net/wireless/morsemicro/mm81x/yaps_hw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c
index 3d641d23c35b..e1102b8fb802 100644
--- a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c
+++ b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c
@@ -486,6 +486,9 @@ static int mm81x_yaps_hw_read_pkts(struct mm81x_yaps *yaps,
 		int total_len;
 		int pkt_size;
 
+		if (bytes_remaining < (int)sizeof(delim))
+			break;
+
 		delim = le32_to_cpu(*((__le32 *)read_ptr));
 		read_ptr += sizeof(delim);
 		bytes_remaining -= sizeof(delim);
-- 
2.55.0