[PATCH v3 4/4] lib: sbi_mpxy: fix integer overflow in attribute range endpoint

[liutong]

Hi Anup,

Thanks for applying these. Before this one goes out, please hold it -
as sent it does not actually fix the overflow.

Widening end_id is not enough. base_attr_id and attr_count are both
u32, so

	end_id = base_attr_id + attr_count - 1;

is evaluated in 32-bit arithmetic and wraps there; the already-wrapped
result is then widened on assignment. With base_attr_id = 0xffffffff
and attr_count = 2 the expression still yields 0, and the msgproto
range check still passes.

	u64 end_id = base + cnt - 1       -> 0x0
	u64 end_id = (u64)base + cnt - 1  -> 0x100000000

The fix is a cast at both sites, lines 500 and 653:

	-	end_id = base_attr_id + attr_count - 1;
	+	end_id = (u64)base_attr_id + attr_count - 1;

I checked that the wider value cannot escape into an index or a loop
bound. In write_attrs() the two loops over attr_id are only reached
after end_id >= SBI_MPXY_ATTR_STD_ATTR_MAX_IDX has been rejected, and
the msgproto branch passes base_attr_id and attr_count to the driver
rather than end_id. read_attrs() has no loop over it.

Happy to send this as a follow-up patch, or you can fold it in with the
2/4 comments, whichever suits you. Sorry for not catching it before
sending.

Regards,
liutong