Re: [PATCH] nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data

[Srinivas Kandagatla]

On Fri, 03 Jul 2026 15:28:52 -0700, Rosen Penev wrote:
> The length check in brcm_nvram_parse() validated header->len against
> priv->nvmem_size (the full partition size) instead of priv->data_len
> (the actual allocated data buffer). A malformed flash partition with
> header->len between the two would pass the check, causing
> brcm_nvram_add_cells() to read and write priv->data[len - 1] beyond
> the heap allocation.
> 
> [...]

Applied, thanks!

[1/1] nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data
      commit: 95e486974c4a0a567e57212fcfca82b372dd8df6

Best regards,
-- 
Srinivas Kandagatla <srini@xxxxxxxxxx>