ASoC: wm_adsp: Fix validation of firmware and coeff lengths
authorBen Hutchings <ben.hutchings@codethink.co.uk>
Fri, 8 Dec 2017 16:15:20 +0000 (16:15 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 2 Jan 2018 19:31:03 +0000 (20:31 +0100)
commit308ddf2afe83994719006200204dc819fcbd9e7a
tree5c4f5e50f72537a33cce136c4e6d15ec6f640d4a
parent23ef17a49f1edfa2c4b437c03b1c0d4da1d116d2
ASoC: wm_adsp: Fix validation of firmware and coeff lengths

commit 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 upstream.

The checks for whether another region/block header could be present
are subtracting the size from the current offset.  Obviously we should
instead subtract the offset from the size.

The checks for whether the region/block data fit in the file are
adding the data size to the current offset and header size, without
checking for integer overflow.  Rearrange these so that overflow is
impossible.

Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sound/soc/codecs/wm_adsp.c