From 3de9978f7031972ecf23e1de4d54c826ac344a5b Mon Sep 17 00:00:00 2001 From: Srinivasarao Pathipati Date: Fri, 3 May 2024 15:13:23 +0530 Subject: [PATCH] soc: qcom: mdt_loader: add bound checks for headers Add checks to ensure that ehdr's size not more than fw->size. Change-Id: Ia17558dfff783dc900ac67475019929ac95fe53b Signed-off-by: Srinivasarao Pathipati --- drivers/soc/qcom/mdt_loader.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c index 38249a1a27d0..a441763fbd29 100644 --- a/drivers/soc/qcom/mdt_loader.c +++ b/drivers/soc/qcom/mdt_loader.c @@ -92,10 +92,16 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len) size_t ehdr_size; void *data; + if (fw->size < sizeof(struct elf32_hdr)) { + dev_err(dev, "Image is too small\n"); + return ERR_PTR(-EINVAL); + } + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(ehdr + 1); - if (ehdr->e_phnum < 2 || ehdr->e_phnum > PN_XNUM) + if (ehdr->e_phnum < 2 || ehdr->e_phoff > fw->size || + (sizeof(phdrs) * ehdr->e_phnum > fw->size - ehdr->e_phoff)) return ERR_PTR(-EINVAL); if (phdrs[0].p_type == PT_LOAD)