A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

soc: qcom: mdt_loader: add bound checks for headers

Browse source 
Add checks to ensure that ehdr's size not more than fw->size.

Change-Id: Ia17558dfff783dc900ac67475019929ac95fe53b
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
This commit is contained in:
Srinivasarao Pathipati 2024-05-03 15:13:23 +05:30
commit 3de9978f70
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/soc/qcom/mdt_loader.c
View file

@ -92,10 +92,16 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
size_t ehdr_size;
void *data;
if (fw->size < sizeof(struct elf32_hdr)) {
dev_err(dev, "Image is too small\n");
return ERR_PTR(-EINVAL);
}
ehdr = (struct elf32_hdr *)fw->data;
phdrs = (struct elf32_phdr *)(ehdr + 1);
if (ehdr->e_phnum < 2 || ehdr->e_phnum > PN_XNUM)
if (ehdr->e_phnum < 2 || ehdr->e_phoff > fw->size ||
(sizeof(phdrs) * ehdr->e_phnum > fw->size - ehdr->e_phoff))
return ERR_PTR(-EINVAL);
if (phdrs[0].p_type == PT_LOAD)