Re: [PATCH] media: venus: guard sequence change packet size

[Dmitry Baryshkov]

On Wed, Jul 08, 2026 at 07:23:32PM +0800, Guangshuo Li wrote:
> The change referenced by the Fixes tag added remaining-byte checks while
> parsing sequence-change event properties.
> 
> However, rem_bytes is initialized by subtracting the fixed event packet
> header size from the firmware-provided packet size. If the packet size is
> smaller than the fixed header, the unsigned subtraction underflows and
> rem_bytes becomes a large value. The per-property bounds checks then no
> longer protect the parser from walking past the received packet buffer.
> 
> Reject undersized sequence-change event packets before computing
> rem_bytes.
> 
> Fixes: 06d6770ff0d8 ("media: venus: Fix OOB read due to missing payload bound check")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
>  drivers/media/platform/qcom/venus/hfi_msgs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxxxxxxxx>


-- 
With best wishes
Dmitry