Re: [PATCH v2] greybus: operation: fix out-of-bounds write in message allocation

[Johan Hovold]

On Fri, Sep 04, 2026 at 10:36:59AM +0200, Johan Hovold wrote:
> On Wed, Sep 02, 2026 at 10:59:16AM -0400, Adriano Cordova wrote:
> > The incoming message size from the device header (header.size) is
> > trusted without checking that it is at least the size of the message
> > header itself, but a value smaller than sizeof(struct gb_operation_msg_hdr)
> > underflows request_size in gb_operation_create_incoming(), wraps around
> > in gb_operation_message_alloc(), and results in a tiny buffer that is
> > then written past its end in gb_operation_message_init().
> 
> Is it really? I was under the impression the only issue here was the
> potential zero-size-pointer deref.

You're right of course, there's a potential small (7 byte) OOB write
here too.

Johan