firmware: Sigma: Prevent out of bounds memory access
commitf18cc6ba85619dfee8ed4a9564ae8c0fcb874cbe
authorLars-Peter Clausen <lars@metafoo.de>
Mon, 28 Nov 2011 08:44:14 +0000 (28 09:44 +0100)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 9 Dec 2011 16:52:38 +0000 (9 08:52 -0800)
treef1fd6d2d0cc5fe9e564943ee4b75e184e02a88d6
parent6a82412403cee54e4ce87b9dea9c275a46d4e682
firmware: Sigma: Prevent out of bounds memory access

commit 4f718a29fe4908c2cea782f751e9805319684e2b upstream.

The SigmaDSP firmware loader currently does not perform enough boundary size
checks when processing the firmware. As a result it is possible that a
malformed firmware can cause an out of bounds memory access.

This patch adds checks which ensure that both the action header and the payload
are completely inside the firmware data boundaries before processing them.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/firmware/sigma.c
include/linux/sigma.h