summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorLars-Peter Clausen <lars@metafoo.de>2011-11-28 09:44:14 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2011-12-09 08:52:38 -0800
commitf18cc6ba85619dfee8ed4a9564ae8c0fcb874cbe (patch)
treef1fd6d2d0cc5fe9e564943ee4b75e184e02a88d6 /include
parent6a82412403cee54e4ce87b9dea9c275a46d4e682 (diff)
firmware: Sigma: Prevent out of bounds memory access
commit 4f718a29fe4908c2cea782f751e9805319684e2b upstream. The SigmaDSP firmware loader currently does not perform enough boundary size checks when processing the firmware. As a result it is possible that a malformed firmware can cause an out of bounds memory access. This patch adds checks which ensure that both the action header and the payload are completely inside the firmware data boundaries before processing them. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'include')
-rw-r--r--include/linux/sigma.h5
1 files changed, 0 insertions, 5 deletions
diff --git a/include/linux/sigma.h b/include/linux/sigma.h
index e2accb3164d8..9a138c2946bb 100644
--- a/include/linux/sigma.h
+++ b/include/linux/sigma.h
@@ -50,11 +50,6 @@ static inline u32 sigma_action_len(struct sigma_action *sa)
return (sa->len_hi << 16) | sa->len;
}
-static inline size_t sigma_action_size(struct sigma_action *sa, u32 payload_len)
-{
- return sizeof(*sa) + payload_len + (payload_len % 2);
-}
-
extern int process_sigma_firmware(struct i2c_client *client, const char *name);
#endif