On Wed, 23 Sep 2026 21:25:24 -0400, Stefan Berger <[email protected]> wrote: > Avoid a potential integer underflow in tpm_crb_fill_command_response > that could occur if s->response_offset > s->response_buffer->len and > the function's call sites were to change. > > tpm_crb_fill_command_response currently has 3 callers that either test > that 's->response_offset < s->response_buffer->len' is true or ensure that > s->response_offset = 0 and s->response_buffer->len >= 0. Therefore, the > integer underflow cannot currently occur. In the worst case the subtraction > would lead to a '0'. > > [...]
Reviewed-by: Marc-André Lureau <[email protected]> -- Marc-André Lureau <[email protected]>
