Re: [PATCH] ihex: Fix 16 bit truncation in ihex_binrec_size()

[Vasileios Almpanis]

On 2026-09-02 14:56:48+02:00, Greg Kroah-Hartman wrote:
> On Wed, Sep 02, 2026 at 02:45:29PM +0200, Vasileios Almpanis wrote:
> 
> > On 2026-09-02 13:06:27+02:00, Greg Kroah-Hartman wrote:
> > 
> > I used fake images. 14 bytes long for the out-of-bounds bug and 6 bytes
> > for the infinite loop. I passed them through the sysfs fallback loader.
> 
> Cool, so root only, fake firmware, not a real issue?  :)

Okay got it, i'll drop Cc: stable

> 
> > Out-Of-Bounds bug image:
> > 00 00 00 00 ff ff 00 00 00 00 00 00 00 00
> > 
> > Infinite-loop image:
> > 00 00 00 00 ff fa
> > 
> > 
> > Yes its root only. The attributes are accessible only through root
> > and it also needs raw-gadget.
> > 
> > 
> > It does, but the value tops out at 65535 + 6 = 65541, so 17 bits, and
> > size_t is at least 32 bits. I chose size_t because sizeof(*p) is already
> > size_t. If you don't like it I can send v2 with u32.
> 
> Let's be specific, otherwise people will trip over the fact that this is
> different sizes.

I'll change it to u32 in v2 shortly.

> 
> thanks,
> 
> greg k-h

Kind regard,
Vasileios Almpanis