[PATCH 0/2] net/bnxt: fix two ULP parser/mapper safety issues

[Manish Kurup]

Two unrelated hardening fixes in the ULP parser/mapper found during
review:

- Patch 1 caps a header-field memcpy() at the field's spec size,
  fixing a potential overflow when the source value is larger than
  the destination field.

- Patch 2 replaces a variable-length array sized by caller input
  with a heap allocation, avoiding unbounded stack growth.

Dakota Sicher (2):
  net/bnxt: cap memcpy at field size
  net/bnxt: replace VLA with heap allocation

 drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c | 10 ++++++++--
 drivers/net/bnxt/tf_ulp/ulp_rte_parser.c | 10 ++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

-- 
2.31.1