[PATCH v2] wifi: brcmfmac: bound NVRAM comment parsing

[Pengpeng Hou]

The NVRAM comment handler searches for a newline with strchr() even
though its input is a firmware buffer with an explicit length. A comment
at the end of an unterminated buffer can make the search read past that
input.

Keep the input extent in the parser and use bounded searches for newline
and NUL. Preserve the full input length: the capped size used to
allocate the output is not a bound on the input, which may contain more
than 64KiB of comments. Leave the outer parsing limit unchanged.

The issue was found by our static-analysis tool.

Fixes: 3e99b08ab53c ("brcmfmac: enhance nvram processing")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: gpt 5
Signed-off-by: Pengpeng Hou <hppiscas@xxxxxxx>
---
Changes since v1:
https://lore.kernel.org/all/20260830135328.12321-1-pengpeng@xxxxxxxxxxx/
Store data_len, not the capped output allocation size, as Arend
requested. Use size_t for the input extent and add the stable Cc
trailer.

 .../broadcom/brcm80211/brcmfmac/firmware.c         |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index 22ff326f1924..a2ee7b43aa21 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -37,6 +37,7 @@ enum nvram_parser_state {
  *
  * @state: current parser state.
  * @data: input buffer being parsed.
+ * @data_len: size of the input buffer, including comments.
  * @nvram: output buffer with parse result.
  * @nvram_len: length of parse result.
  * @line: current line.
@@ -51,6 +52,7 @@ enum nvram_parser_state {
 struct nvram_parser {
 	enum nvram_parser_state state;
 	const u8 *data;
+	size_t data_len;
 	u8 *nvram;
 	u32 nvram_len;
 	u32 line;
@@ -171,12 +173,14 @@ brcmf_nvram_handle_value(struct nvram_parser *nvp)
 static enum nvram_parser_state
 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
 {
-	char *eoc, *sol;
+	const char *eoc, *sol;
+	size_t remaining;
 
-	sol = (char *)&nvp->data[nvp->pos];
-	eoc = strchr(sol, '\n');
+	sol = (const char *)&nvp->data[nvp->pos];
+	remaining = nvp->data_len - nvp->pos;
+	eoc = strnchr(sol, remaining, '\n');
 	if (!eoc) {
-		eoc = strchr(sol, '\0');
+		eoc = memchr(sol, '\0', remaining);
 		if (!eoc)
 			return END;
 	}
@@ -210,6 +214,7 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
 
 	memset(nvp, 0, sizeof(*nvp));
 	nvp->data = data;
+	nvp->data_len = data_len;
 	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
 	if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
 		size = BRCMF_FW_MAX_NVRAM_SIZE;

base-commit: 518e5b794c06c0f0eb40df3e202274a66202c137
-- 
2.50.1 (Apple Git-155)