This series fixes various missing length checks when processing variable-length data from the firmware file. These could have caused overrunning the end of firmware file buffer, or wild pointer accesses. Richard Fitzgerald (4): firmware: cs_dsp: Fix overflow checking of wmfw header firmware: cs_dsp: Return error if block header overflows file firmware: cs_dsp: Validate payload length before processing block firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers drivers/firmware/cirrus/cs_dsp.c | 223 ++++++++++++++++++++++--------- 1 file changed, 160 insertions(+), 63 deletions(-) -- 2.39.2