This series fixes various missing length checks when processing variable-length data from the firmware file. These could have caused overrunning the end of firmware file buffer, or wild pointer accesses. Richard Fitzgerald (4): firmware: cs_dsp: Fix overflow checking of wmfw header firmware: cs_dsp: Return error if block header overflows file firmware: cs_dsp: Validate payload length before processing block firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers drivers/firmware/cirrus/cs_dsp.c | 223 ++++++++++++++++++++++--------- 1 file changed, 160 insertions(+), 63 deletions(-) -- 2.39.2
- Follow-Ups:
- Re: [PATCH 0/4] firmware: cs_dsp: Add check to prevent overrunning the firmware file
- From: Mark Brown
- [PATCH 1/4] firmware: cs_dsp: Fix overflow checking of wmfw header
- From: Richard Fitzgerald
- [PATCH 4/4] firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
- From: Richard Fitzgerald
- [PATCH 2/4] firmware: cs_dsp: Return error if block header overflows file
- From: Richard Fitzgerald
- [PATCH 3/4] firmware: cs_dsp: Validate payload length before processing block
- From: Richard Fitzgerald
- Re: [PATCH 0/4] firmware: cs_dsp: Add check to prevent overrunning the firmware file
- Prev by Date: Re: [PATCH 4/6] ASoC: codecs: wsa884x: parse port-mapping information
- Next by Date: [PATCH 3/4] firmware: cs_dsp: Validate payload length before processing block
- Previous by thread: [PATCH] ASoC: codecs: lpass-wsa-macro: add missing select of common code
- Next by thread: [PATCH 3/4] firmware: cs_dsp: Validate payload length before processing block
- Index(es):