Re: [PATCH] i2c: cp2615: Validate read length before copying

[Andi Shyti]

Hi Triet,

On Tue, Aug 18, 2026 at 12:47:37PM +0000, Triet Hoang wrote:
> The read_len field comes from the untrusted USB payload, which could
> potentially exceed the client's originally requested buffer length or
> MAX_I2C_SIZE, allowing an out-of-bounds read and write.

have you experienced any issue yourself or are you just
speculating based on the code?

Andi

> Limit read_len to the maximum size of the response buffer and return
> -EPROTO for an invalid response.
> 
> Signed-off-by: Triet Hoang <triet.hoang.dev@xxxxxxxxx>