Messages in this thread | | | From | Steve Lee <> | Subject | RE: [PATCH] ASoC: max98390: Fix potential crash during param fw loading | Date | Wed, 3 Jun 2020 11:37:44 +0000 |
| |
> -----Original Message----- > From: Mark Brown <broonie@kernel.org> > Sent: Wednesday, June 3, 2020 8:32 PM > To: Steve Lee <SteveS.Lee@maximintegrated.com> > Cc: lgirdwood@gmail.com; perex@perex.cz; tiwai@suse.com; > ckeepax@opensource.cirrus.com; geert@linux-m68k.org; > rf@opensource.wolfsonmicro.com; shumingf@realtek.com; > srinivas.kandagatla@linaro.org; krzk@kernel.org; dmurphy@ti.com; > jack.yu@realtek.com; nuno.sa@analog.com; linux-kernel@vger.kernel.org; > alsa-devel@alsa-project.org; ryan.lee.maxim@gmail.com; Ryan Lee > <RyanS.Lee@maximintegrated.com>; steves.lee.maxim@gmail.com > Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw > loading > > On Wed, Jun 03, 2020 at 08:18:19PM +0900, Steve Lee wrote: > > > + param_start_addr = (dsm_param[0] & 0xff) | (dsm_param[1] & 0xff) << > 8; > > + param_size = (dsm_param[2] & 0xff) | (dsm_param[3] & 0xff) << 8; > > + if (param_size > MAX98390_DSM_PARAM_MAX_SIZE || > > + param_start_addr < DSM_STBASS_HPF_B0_BYTE0) { > > + dev_err(component->dev, > > + "param fw is invalid.\n"); > > + goto err_alloc; > > + } > > This is now reading the size out of the header of the file which is good but it > should also validate that the file is big enough to have this much data in it, > otherwise it's possible to read beyond the end of the firmware file (eg, if it got > truncated somehow). Previously the code used the size of the file read from disk > so that wasn't an issue.
Thanks for quick comment. Can this case cover by below line? + if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) { + dev_err(component->dev, + "param fw is invalid.\n"); + goto err_alloc; + }
| |