The SigmaDSP firmware loader currently does not perform enough boundary size checks when processing the firmware. As a result it is possible that a malformed firmware can cause an out of bounds memory access. This patch adds checks which ensure that both the action header and the payload are completely inside the firmware data boundaries before processing them.
Showing the changes to include/linux (1 of 2 files). Show all
Unified · Split
| @@ -50,11 +50,6 @@ static inline u32 sigma_action_len(struct sigma_action *sa) · 49 unmodified lines | |||
| 50 | return (sa->len_hi << 16) | sa->len; | 50 | return (sa->len_hi << 16) | sa->len; |
| 51 | } | 51 | } |
| 52 | 52 | ||
| 53 | static inline size_t sigma_action_size(struct sigma_action *sa, u32 payload_len) | ||
| 54 | { | ||
| 55 | return sizeof(*sa) + payload_len + (payload_len % 2); | ||
| 56 | } | ||
| 57 | |||
| 58 | extern int process_sigma_firmware(struct i2c_client *client, const char *name); | 53 | extern int process_sigma_firmware(struct i2c_client *client, const char *name); |
| 59 | 54 | ||
| 60 | #endif | 55 | #endif |