Re: [PATCH v2] iio: chemical: scd30: reject (response=NULL, size>0) in scd30_i2c_command()

["Maxwell Doose" <m32285159@gmail.com>]

On Thu May 7, 2026 at 10:28 AM CDT, Stepan Ionichev wrote:
> scd30_i2c_command() takes an opaque "response" buffer plus its size.
> At the start of the function the code already checks if response is
> NULL (via the rsp local), but the response-decoding loop after the
> i2c transfer always dereferences rsp without re-checking. With the
> current callers in scd30_core.c this is harmless, since write
> commands pass response=NULL together with size=0 (so the loop body
> is never entered).
>
[snip]
> @@ -71,6 +71,9 @@ static int scd30_i2c_command(struct scd30_state *state, enum scd30_cmd cmd, u16
>  	int i, ret;
>  	char crc;
>
> +	if (!response && size != 0)
> +		return -EINVAL;
> +
>  	put_unaligned_be16(scd30_i2c_cmd_lookup_tbl[cmd], buf);
>  	i = 2;
>

I guess we're still handling the cases where both response/rsp and
size are zero here below?

	if (rsp) {
		/* each two bytes are followed by a crc8 */
		size += size / 2;
	} else {
		put_unaligned_be16(arg, buf + i);
		crc = crc8(scd30_i2c_crc8_tbl, buf + i, 2, CRC8_INIT_VALUE);
		i += 2;
		buf[i] = crc;
		i += 1;

		/* commands below don't take an argument */
		if ((cmd == CMD_STOP_MEAS) || (cmd == CMD_RESET))
			i -= 3;
	}

Should add a comment showing that this handles this case but that's
just my personal nit. Not worth forcing a v3 so

Acked-by: Maxwell Doose <m32285159@gmail.com>

best regards,
max