Posted by Ron E on Aug 26The Realtek in-band ioctl bridge contains a heap-buffer overflow when processing peer-supplied ioctl response data. inband_ioctl() receives a response through the Realtek in-band transport and extracts a 32-bit data_get_len value from that response. For several wireless "get" operations, this peer-controlled value is subsequently used directly as the length argument to memcpy(). For SIOCGIWSCAN, the destination is a caller-provided...