[PATCH] staging: nvec: validate battery response length before memcpy

[Sebastian Josue Alba Vives <sebasjosue84@gmail.com>]

In nvec_power_notifier(), the response length from the embedded
controller is used directly as the size argument to memcpy() when
copying battery manufacturer, model, and type strings. The
destination buffers (bat_manu, bat_model, bat_type) are fixed at 30
bytes, but res->length is a u8 that can be up to 255, allowing a
heap buffer overflow.

Additionally, if res->length is less than 2, the subtraction
res->length - 2 wraps around as an unsigned value, resulting in a
large copy that corrupts kernel heap memory.

Add bounds checks before each memcpy to ensure the copy length does
not exceed the destination buffer size, and that res->length is at
least 2 to prevent unsigned integer underflow.

Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Josue Alba Vives <sebasjosue84@gmail.com>
---
 drivers/staging/nvec/nvec_power.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/staging/nvec/nvec_power.c b/drivers/staging/nvec/nvec_power.c
index 2faab9fde..29beef0a7 100644
--- a/drivers/staging/nvec/nvec_power.c
+++ b/drivers/staging/nvec/nvec_power.c
@@ -193,14 +193,20 @@ static int nvec_power_bat_notifier(struct notifier_block *nb,
 		power->bat_temperature = res->plu - 2732;
 		break;
 	case MANUFACTURER:
+		if (res->length < 2 || res->length - 2 > sizeof(power->bat_manu) - 1)
+			break;
 		memcpy(power->bat_manu, &res->plc, res->length - 2);
 		power->bat_manu[res->length - 2] = '\0';
 		break;
 	case MODEL:
+		if (res->length < 2 || res->length - 2 > sizeof(power->bat_model) - 1)
+			break;
 		memcpy(power->bat_model, &res->plc, res->length - 2);
 		power->bat_model[res->length - 2] = '\0';
 		break;
 	case TYPE:
+		if (res->length < 2 || res->length - 2 > sizeof(power->bat_type) - 1)
+			break;
 		memcpy(power->bat_type, &res->plc, res->length - 2);
 		power->bat_type[res->length - 2] = '\0';
 		/*
-- 
2.43.0