On Sat, 24 Jan 2026 18:18:29 -0500 Joel Fernandes <[email protected]> wrote:
> Use checked_add() when computing the firmware data end offset in the > BinFirmware::data() method. The data_offset and data_size fields come > from the BinHdr structure parsed from the firmware file header. > > Signed-off-by: Joel Fernandes <[email protected]> > --- > drivers/gpu/nova-core/firmware.rs | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/nova-core/firmware.rs > b/drivers/gpu/nova-core/firmware.rs index 68779540aa28..4f57a270e142 > 100644 --- a/drivers/gpu/nova-core/firmware.rs > +++ b/drivers/gpu/nova-core/firmware.rs > @@ -394,8 +394,9 @@ fn new(fw: &'a firmware::Firmware) -> Result<Self> { > fn data(&self) -> Option<&[u8]> { > let fw_start = usize::from_safe_cast(self.hdr.data_offset); > let fw_size = usize::from_safe_cast(self.hdr.data_size); > + let fw_end = fw_start.checked_add(fw_size)?; > > - self.fw.get(fw_start..fw_start + fw_size) > + self.fw.get(fw_start..fw_end) > } > } > Reviewed-by: Zhi Wang <[email protected]>
