> -----Original Message-----
> From: Mark Brown <[email protected]>
> Sent: Wednesday, June 3, 2020 8:32 PM
> To: Steve Lee <[email protected]>
> Cc: [email protected]; [email protected]; [email protected];
> [email protected]; [email protected];
> [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; Ryan Lee
> <[email protected]>; [email protected]
> Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw
> loading
>
> On Wed, Jun 03, 2020 at 08:18:19PM +0900, Steve Lee wrote:
>
> > + param_start_addr = (dsm_param[0] & 0xff) | (dsm_param[1] & 0xff) <<
> 8;
> > + param_size = (dsm_param[2] & 0xff) | (dsm_param[3] & 0xff) << 8;
> > + if (param_size > MAX98390_DSM_PARAM_MAX_SIZE ||
> > + param_start_addr < DSM_STBASS_HPF_B0_BYTE0) {
> > + dev_err(component->dev,
> > + "param fw is invalid.\n");
> > + goto err_alloc;
> > + }
>
> This is now reading the size out of the header of the file which is good but
> it
> should also validate that the file is big enough to have this much data in it,
> otherwise it's possible to read beyond the end of the firmware file (eg, if
> it got
> truncated somehow). Previously the code used the size of the file read from
> disk
> so that wasn't an issue.
Thanks for quick comment. Can this case cover by below line?
+ if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
+ dev_err(component->dev,
+ "param fw is invalid.\n");
+ goto err_alloc;
+ }
