On Wed, Nov 6, 2024 at 6:47 PM Pierrick Bouvier <pierrick.bouv...@linaro.org> wrote:
> > for (int i = 0; i < MAX_SECTIONS; ++i) { > > header->section_offsets[i] = > > be64_to_cpu(header->section_offsets[i]); > > + if (header->section_offsets[i] > OFF_MAX) { > > Maybe we could add a comment that sections_offsets is unsigned, as it > can be confusing to read value > INT_MAX without more context. It does sound like OFF_MAX is related to section_offsets[], but it's actually related to off_t. So the comparison is with the maximum value of off_t, which is signed. The problem would happen even if section_offsets[] was signed (for example off_t could be 32-bit). Paolo > > + error_setg(errp, "Invalid EIF image. Section offset out of > > bounds"); > > + return false; > > + } > > } > > > > for (int i = 0; i < MAX_SECTIONS; ++i) { > > Else, > Reviewed-by: Pierrick Bouvier <pierrick.bouv...@linaro.org> >