[PATCH 08/16] ASoC: SOF: amd: require full ACP header for ACP7 signed firmware
From: Vijendar Mukunda
Date: Wed Jul 01 2026 - 06:01:01 EST
ACP7.B/7.F signed images read SizeFWSigned from a fixed offset inside
the ACP header. Reject firmware buffers shorter than the header so we
never read past the end of the supplied image.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@xxxxxxx>
Reviewed-by: Bard Liao <yung-chuan.liao@xxxxxxxxxxxxxxx>
---
sound/soc/sof/amd/acp-loader.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/soc/sof/amd/acp-loader.c b/sound/soc/sof/amd/acp-loader.c
index af04f053fd65..e4a17e6656c0 100644
--- a/sound/soc/sof/amd/acp-loader.c
+++ b/sound/soc/sof/amd/acp-loader.c
@@ -176,6 +176,11 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev)
if (adata->pci_rev >= ACP7B_PCI_ID) {
if (adata->acp_sof_signed_firmware_image) {
+ if (adata->fw_bin_size <= ACP_IMAGE_HEADER_SIZE) {
+ dev_err(sdev->dev, "Invalid signed firmware size %u\n",
+ adata->fw_bin_size);
+ return -EINVAL;
+ }
size_fw = get_unaligned_le32(adata->bin_buf +
ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF);
size_fw += ACP_IMAGE_HEADER_SIZE;
--
2.45.2