Skip to content

Commit fda3e4a

Browse files
committed
firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
jira LE-3201 cve CVE-2024-41056 Rebuild_History Non-Buildable kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 commit-author Richard Fitzgerald <rf@opensource.cirrus.com> commit 680e126 Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. cs_dsp should protect against overrunning the array if the NUL terminator is missing. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Fixes: f6bc909 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") Link: https://patch.msgid.link/20240708144855.385332-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org> (cherry picked from commit 680e126) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent 016e40b commit fda3e4a

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/firmware/cirrus/cs_dsp.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1128,7 +1128,7 @@ static int cs_dsp_coeff_parse_alg(struct cs_dsp *dsp,
11281128

11291129
blk->id = le32_to_cpu(raw->id);
11301130
blk->name = raw->name;
1131-
blk->name_len = strlen(raw->name);
1131+
blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name));
11321132
blk->ncoeff = le32_to_cpu(raw->ncoeff);
11331133

11341134
pos = sizeof(*raw);
@@ -1204,7 +1204,7 @@ static int cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp,
12041204
return -EOVERFLOW;
12051205

12061206
blk->name = raw->name;
1207-
blk->name_len = strlen(raw->name);
1207+
blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name));
12081208
blk->ctl_type = le16_to_cpu(raw->ctl_type);
12091209
blk->flags = le16_to_cpu(raw->flags);
12101210
blk->len = le32_to_cpu(raw->len);

0 commit comments

Comments
 (0)