Re: [PATCH] media: cec: extron-da-hd-4k-plus: add sanity check

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

Hi Hans,

Thank you for the patch.

On Thu, Jun 18, 2026 at 01:03:19PM +0200, Hans Verkuil wrote:
> Add check to prevent overflowing msg.msg[] in case the incoming data
> is malformed.
> 
> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
> ---
> diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
> index 3381d86096a1..3c6ce6f3d93e 100644
> --- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
> +++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
> @@ -657,7 +657,8 @@ static void extron_process_received(struct extron_port *port, const char *data)
>  	if (!port || port->disconnected)
>  		return;
> 
> -	if (len < 5 || (len - 2) % 3 || data[len - 2] != '*')
> +	if (len < 5 || ((len - 2) / 3 > sizeof(msg.msg)) ||

I think you should use ARRAY_SIZE

> +	    (len - 2) % 3 || data[len - 2] != '*')

This seems correct, but I think the code would be easier to read and
maintain if you wrote

	int len;

	/* The last two bytes are ignored because ... */
	len = strlen(data) - 2;

	/*
	 * Ensure the data has at least one message, at most the number
	 * of messages that fit in msg.msg, and no extra bytes.
	 */
	if (len < 3 || len / 3 > ARRAY_SIZE(msg.msg) || len % 3)
  		goto malformed;

	if (data[len] != '*')
  		goto malformed;

>  		goto malformed;
> 
>  	while (*data != '*') {
> 

-- 
Regards,

Laurent Pinchart