On Fri, Sep 04, 2026 at 03:46:28AM +0000, Suraj Theekshana wrote:

cap_get_ims_certificate() and cap_authenticate() derive copy lengths from response payload sizes without checking the response header size or destination capacity.

How was this found and tested?

And doesn't this info come from the hardware itself? Is it not trusted here?

Reject responses smaller than their headers with -EMSGSIZE. Reject certificate and signature data larger than their fixed ioctl buffers with -E2BIG.

Signed-off-by: Suraj Theekshana surajtheekshana1111@gmail.com

Did you forget an Assisted-by: tag?

thanks,

greg k-h