Re: [PATCH] platform/chrome: cros_ec_typec: reject out-of-bounds PD cap count

[Maoyi Xie]

Hi Andrei,

> Are we only rejecting `out-of-bounds PD cap count` here?

Yes, just the PD cap count for now. That is the only one that feeds a
write, the memcpy into the stack array caps_desc.pdo[PDO_MAX_OBJECTS].

The same path trusts a few read counts too.
cros_typec_register_altmodes() reads svids[] and mode_vdo[6] using
svid_count and mode_count. cros_typec_handle_vdm_response() passes
resp.vdm_data_objects to typec_altmode_vdm() with no check against the
fixed resp.vdm_response[]. cros_typec_parse_pd_identity() is already capped
at VDO_MAX_OBJECTS.

I scoped this to the write so it stays small and backportable. If you
prefer, I can send patches for the other three.

Thanks,
Maoyi