Re: [PATCH v2] iio: proximity: hx9023s: validate firmware size

[Andy Shevchenko]

On Sat, Jul 11, 2026 at 08:25:58AM +0545, Laxman Acharya Padhya wrote:
> hx9023s_send_cfg() copies the firmware into a counted flexible array and
> then reads fixed offsets from the copied data before walking register/value
> pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore
> make the driver read past the copied buffer during probe-time configuration
> loading.
> 
> Reject firmware images that cannot contain the fixed header, reject images
> too large for the u16 fw_size field, and validate that the advertised
> register count fits in the remaining payload.

> Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing
> functionality")

Actually the tags are supposed to be "one (full) tag per line". In the second
message it seems incorrectly wrapped.

Also see my reply to the other email of yours.

-- 
With Best Regards,
Andy Shevchenko