Re: [PATCH v3 2/2] media: venus: Fix OOB read due to missing payload bound check

[Bryan O'Donoghue]

On 14/05/2025 14:38, Dikshita Agarwal wrote:
> From: Vedang Nagar <quic_vnagar@xxxxxxxxxxx>
>
> Currently, The event_seq_changed() handler processes a variable number
> of properties sent by the firmware. The number of properties is indicated
> by the firmware and used to iterate over the payload. However, the
> payload size is not being validated against the actual message length.
>
> This can lead to out-of-bounds memory access if the firmware provides a
> property count that exceeds the data available in the payload. Such a
> condition can result in kernel crashes or potential information leaks if
> memory beyond the buffer is accessed.
>
> Fix this by properly validating the remaining size of the payload before
> each property access and updating bounds accordingly as properties are
> parsed.
>
> This ensures that property parsing is safely bounded within the received
> message buffer and protects against malformed or malicious firmware
> behavior.
>
> Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)")
> Signed-off-by: Vedang Nagar <quic_vnagar@xxxxxxxxxxx>
> Co-developed-by: Dikshita Agarwal <quic_dikshita@xxxxxxxxxxx>
> Signed-off-by: Dikshita Agarwal <quic_dikshita@xxxxxxxxxxx>

Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@xxxxxxxxxx>