iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ASoC: topology: Add header payload_size verification

Browse Source 
Add sanity check to make sure the data is read within file boundary.
Helps in situations where file is only partially copied or malformed.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20211015161257.27052-3-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Cezary Rojewski 2021-10-15 18:12:53 +02:00 committed by Mark Brown
parent 7db53c21b1
commit 86e2d14b6d
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sound/soc/soc-topology.c
View File

@ -2438,6 +2438,7 @@ static int soc_tplg_manifest_load(struct soc_tplg *tplg,
_manifest = manifest; _manifest = manifest;
} else { } else {
abi_match = false; abi_match = false;
ret = manifest_new_ver(tplg, manifest, &_manifest); ret = manifest_new_ver(tplg, manifest, &_manifest);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -2468,6 +2469,14 @@ static int soc_valid_header(struct soc_tplg *tplg,
return -EINVAL; return -EINVAL;
} }
if (soc_tplg_get_hdr_offset(tplg) + hdr->payload_size >= tplg->fw->size) {
dev_err(tplg->dev,
"ASoC: invalid header of type %d at offset %ld payload_size %d\n",
le32_to_cpu(hdr->type), soc_tplg_get_hdr_offset(tplg),
hdr->payload_size);
return -EINVAL;
}
/* big endian firmware objects not supported atm */ /* big endian firmware objects not supported atm */
if (le32_to_cpu(hdr->magic) == SOC_TPLG_MAGIC_BIG_ENDIAN) { if (le32_to_cpu(hdr->magic) == SOC_TPLG_MAGIC_BIG_ENDIAN) {
dev_err(tplg->dev, dev_err(tplg->dev,