OSDN Git Service

ASoC: SOF: ipc3: Check for upper size limit for the received message
authorPeter Ujfalusi <peter.ujfalusi@linux.intel.com>
Tue, 7 Mar 2023 11:49:17 +0000 (13:49 +0200)
committerMark Brown <broonie@kernel.org>
Tue, 7 Mar 2023 13:57:55 +0000 (13:57 +0000)
commit989a3e4479177d0f4afab8be1960731bc0ffbbd0
treecabc329c4a89426482fda1aebf33a58bbfa1b3ea
parent38d408f5b1250d56f8a19d2f2ff65aa8c7b93ff4
ASoC: SOF: ipc3: Check for upper size limit for the received message

The sof_ipc3_rx_msg() checks for minimum size of a new rx message but it is
missing the check for upper limit.
Corrupted or compromised firmware might be able to take advantage of this
to cause out of bounds reads outside of the message area.

Reported-by: Curtis Malainey <cujomalainey@chromium.org>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Curtis Malainey <curtis@malainey.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20230307114917.5124-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/sof/ipc3.c