Re: [PATCH] media: cec: extron-da-hd-4k-plus: add sanity check

[Sean Young <sean@mess.org>]

On Thu, Jun 18, 2026 at 01:16:22PM +0200, Hans Verkuil wrote:
> On 18/06/2026 13:03, Hans Verkuil wrote:
> > Add check to prevent overflowing msg.msg[] in case the incoming data
> > is malformed.
> > 
> > Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
> 
> Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
> Cc: stable@vger.kernel.org

Looks good.

Reviewed-by: Sean Young <sean@mess.org>

> 
> Regards,
> 
> 	Hans
> 
> > ---
> > diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
> > index 3381d86096a1..3c6ce6f3d93e 100644
> > --- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
> > +++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
> > @@ -657,7 +657,8 @@ static void extron_process_received(struct extron_port *port, const char *data)
> >  	if (!port || port->disconnected)
> >  		return;
> > 
> > -	if (len < 5 || (len - 2) % 3 || data[len - 2] != '*')
> > +	if (len < 5 || ((len - 2) / 3 > sizeof(msg.msg)) ||
> > +	    (len - 2) % 3 || data[len - 2] != '*')
> >  		goto malformed;
> > 
> >  	while (*data != '*') {
> > 
>