Re: [PATCH v6] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()

[Andy Shevchenko]

On Fri, Oct 16, 2026 at 07:53:52AM +0500, Muhammad Bilal wrote:
> The input is copied with kstrdup(), which stops at the first NUL, but
> the full write size is passed to hp_enforce_single_line_input(). With
> an embedded NUL the helper reads, and can write one byte, past the
> copy. Return -EINVAL if the input contains a NUL.
>  
> Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0"
> followed by 4093 bytes of "B" to current_password 100 times returns
> -EINVAL every time, without reading into the heap.

...

>  {
>  	char *p;
>  
> +	/* buf is a string, so a NUL before count is invalid input */
> +	if (strnlen(buf, count) < count)
> +		return -EINVAL;
> +
>  	p = memchr(buf, '\n', count);
>  
>  	if (p == buf + count - 1)

Let's look at the full implementation

int hp_enforce_single_line_input(char *buf, size_t count)
{
	char *p;

	p = memchr(buf, '\n', count);

	if (p == buf + count - 1)
		*p = '\0'; /* strip trailing newline */
	else if (p)
		return -EINVAL;  /* enforce single line input */

	return 0;
}

With your enforcement in place the rest can be simplified and refactored.
The hint is to use strnchrnul().

int hp_enforce_single_line_input(char *buf, size_t count)
{
	char *p;

	p = strnchrnul(buf, count, '\n');

	if (p == buf + count - 1)
		*p = '\0'; /* strip trailing newline */
	else if (p < buf + count - 1)
		return -EINVAL;  /* enforce single line input */

	return 0;
}

(the above done with the less intrusive changes)

-- 
With Best Regards,
Andy Shevchenko