[PATCH] virt: nsm: decode all short CBOR array lengths

[Yousef Alhouseen]

CBOR encodes array lengths from zero through 23 directly in the
initial byte.  The decoder only handled 23, leaving array_len
uninitialized for every other short-form length.

Accept the full short-form range and reject reserved
additional-information values above the supported 64-bit encoding.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
 drivers/misc/nsm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b32742340..b4e608522340 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -105,6 +105,8 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
 		return -EFAULT;
 
 	cbor_short_size = (cbor_object[0] & 0x1F);
+	if (cbor_short_size > CBOR_LONG_SIZE_U64)
+		return -EFAULT;
 
 	/* Decoding byte array length */
 	array_offset = CBOR_HEADER_SIZE_SHORT;
@@ -117,7 +119,7 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
 	array_len_p = &cbor_object[1];
 
 	switch (cbor_short_size) {
-	case CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
+	case 0 ... CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
 		array_len = cbor_short_size;
 		break;
 	case CBOR_LONG_SIZE_U8:
-- 
2.54.0