Re: [PATCH v7] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()

[Muhammad Bilal]

Hi Andy,

No particular reason. I removed them while trimming the diff, but
you're right that both comments are still useful. I'll restore them in
the next revision.

Thanks,
Muhammad

On Mon, Oct 26, 2026 at 12:52 AM Andy Shevchenko
<andriy.shevchenko@xxxxxxxxxxxxxxx> wrote:
>
> On Sat, Oct 24, 2026 at 10:26:41PM +0500, Muhammad Bilal wrote:
> > The input is copied with kstrdup(), which stops at the first NUL, but
> > the full write size is passed to hp_enforce_single_line_input(). With
> > an embedded NUL the helper reads, and can write one byte, past the
> > copy. Use strnchrnul() so the scan stops at the first NUL, and return
> > -EINVAL for a NUL or newline before the last byte.
> >
> > Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0"
> > followed by 4093 bytes of "B" to current_password 100 times returns
> > -EINVAL every time, without reading into the heap.
>
> ...
>
> >  - Drop the trailing comments
>
> Why? At least The first one has the same meaning as before, what's wrong with
> the second one?
>
> --
> With Best Regards,
> Andy Shevchenko
>
>