Re: [PATCH v6 3/3] fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
Xu Yilun <[email protected]> Mon, 18 May 2026 22:44:27 +0800
| Newsgroups | org.kernel.vger.linux-fpga,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <agslyzwn9aeBVUwj@yilunxu-OptiPlex-7050> |
On Tue, May 12, 2026 at 07:07:10AM -0600, Sebastian Alba Vives wrote: > mpf_ops_parse_header() reads header_size from the bitstream at > MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression > *(buf + header_size - 1) reads one byte before the buffer start. > > Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core > guarantees the buffer is always large enough to reach MPF_HEADER_SIZE_OFFSET. "WARNING: Prefer a maximum 75 chars per line", again use checkpatch.