Claude review: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
Author: Ashutosh Desai <ashutoshdesai993@gmail.com>
Patches: 1
Reviewed: 2026-05-16T16:07:31.754498

---

This is a single-patch series that fixes two out-of-bounds read vulnerabilities in the DP MST sideband reply parsers. The fix is straightforward and correct: it ensures the full range of bytes to be copied (`idx + num_bytes`) is validated against `curlen` before each `memcpy`, rather than just checking the current index position.

The patch is well-motivated — `raw->msg[]` is 256 bytes and `curlen` is `u8` (max 255), so a malicious or misbehaving MST hub could craft a reply with `num_bytes` set larger than the remaining payload, causing the `memcpy` to read past the valid message data. Both destination buffers (`bytes[255]`) are large enough for the max `u8` value, so no destination overflow is possible — the issue is purely about reading past the received data in `raw->msg[]`.

**Verdict: Looks good.** The fix is minimal, correct, and appropriate for stable backport.

---

---
Generated by Claude Code Patch Reviewer