[PATCH] staging: rtl8723bs: fix null pointer deref in rtw_check_bcn_info

[luka . gejak]

From: Luka Gejak <luka.gejak@xxxxxxxxx>

When parsing beacon or probe response frames, if the ap does not provide
a valid ssid ie, rtw_get_ie() returns NULL. The code then blindly
performs a memcpy() using the returned NULL pointer (p + 2), resulting
in a kernel oops or kernel panic due to a NULL pointer dereference.

Fix this by moving the memcpy() inside the if (p) block so it is only
executed when a valid ssid ie is actually found.

Fixes: 370730894bec ("Staging: rtl8723bs: rtw_wlan_util: Add size check of SSID IE")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Luka Gejak <luka.gejak@xxxxxxxxx>
---
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 6a7c09db4cd9..2a8aec37d9b0 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1204,8 +1204,8 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
 		ssid_len = *(p + 1);
 		if (ssid_len > NDIS_802_11_LENGTH_SSID)
 			ssid_len = 0;
+		memcpy(bssid->ssid.ssid, (p + 2), ssid_len);
 	}
-	memcpy(bssid->ssid.ssid, (p + 2), ssid_len);
 	bssid->ssid.ssid_length = ssid_len;
 
 	if (memcmp(bssid->ssid.ssid, cur_network->network.ssid.ssid, 32) ||
-- 
2.53.0