[PATCH] media: venus: guard sequence change packet size

[Guangshuo Li]

The change referenced by the Fixes tag added remaining-byte checks while
parsing sequence-change event properties.

However, rem_bytes is initialized by subtracting the fixed event packet
header size from the firmware-provided packet size. If the packet size is
smaller than the fixed header, the unsigned subtraction underflows and
rem_bytes becomes a large value. The per-property bounds checks then no
longer protect the parser from walking past the received packet buffer.

Reject undersized sequence-change event packets before computing
rem_bytes.

Fixes: 06d6770ff0d8 ("media: venus: Fix OOB read due to missing payload bound check")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/media/platform/qcom/venus/hfi_msgs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c
index 47b99d5b5af7..ff60bc745f8e 100644
--- a/drivers/media/platform/qcom/venus/hfi_msgs.c
+++ b/drivers/media/platform/qcom/venus/hfi_msgs.c
@@ -55,6 +55,9 @@ static void event_seq_changed(struct venus_core *core, struct venus_inst *inst,
 	if (!num_properties_changed)
 		goto error;
 
+	if (pkt->shdr.hdr.size < sizeof(*pkt))
+		goto error;
+
 	data_ptr = (u8 *)&pkt->ext_event_data[0];
 	rem_bytes = pkt->shdr.hdr.size - sizeof(*pkt);
 
-- 
2.43.0