[PATCH] platform/chrome: lightbar: Enforce 8-bit payload limit

[Alexis Savery <asavery@google.com>]

The LIGHTBAR_CMD_SET_PROGRAM_EX command encapsulates its payload data
with an 8-bit size field `uint8_t size`. However, the driver currently
allows the payload chunk to bypass this limit if the EC transport layer
supports a larger max_request.

When this occurs, large payloads (e.g., >255 bytes limit) overflow the
8-bit size variable when assigning `param->set_program_ex.size`, causing
truncation and parse failures in the EC firmware.

This change functionally clamps max_size dynamically against the struct
maximum (255 bytes).

Signed-off-by: Alexis Savery <asavery@google.com>
---
 drivers/platform/chrome/cros_ec_lightbar.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
index 02a6c34e68e6..a8df36260419 100644
--- a/drivers/platform/chrome/cros_ec_lightbar.c
+++ b/drivers/platform/chrome/cros_ec_lightbar.c
@@ -496,9 +496,16 @@ static ssize_t program_store(struct device *dev, struct device_attribute *attr,
 			return -EINVAL;
 		}
 	} else {
+		/*
+		 * The LIGHTBAR_CMD_SET_PROGRAM_EX payload uses a uint8_t size field.
+		 * Thus, independent of the transport limits, the maximum payload subset
+		 * that can be transmitted in a single structure is 255 bytes.
+		 */
+		const size_t max_struct_payload = 255;
 		extra_bytes = offsetof(typeof(*param), set_program_ex) +
 			sizeof(param->set_program_ex);
-		max_size = ec->ec_dev->max_request - extra_bytes;
+		max_size = min((size_t)(ec->ec_dev->max_request - extra_bytes),
+			       max_struct_payload);
 	}
 
 	msg = alloc_lightbar_cmd_msg(ec);
-- 
2.55.0.508.g3f0d502094-goog