[PATCH] media: siano: validate family2 firmware extents

[Pengpeng Hou]

smscore_load_firmware_family2() reads the firmware header and a fixed
reload address before proving that those bytes are present. It also uses
the complete blob size as the payload remainder even though payload starts
after the header.

Validate the header, bind the declared payload length to the firmware blob,
require the reload-address field when needed, and download only the
declared payload.

Fixes: 018b0c6f8acb ("[media] siano: make load firmware logic to work with newer firmwares")
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/media/common/siano/smscoreapi.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
index 017629e3cf84b..54e9617513eed 100644
--- a/drivers/media/common/siano/smscoreapi.c
+++ b/drivers/media/common/siano/smscoreapi.c
@@ -909,12 +909,23 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev,
 {
 	struct sms_firmware *firmware = (struct sms_firmware *) buffer;
 	struct sms_msg_data5 *msg;
+	size_t payload_size;
 	u32 mem_address,  calc_checksum = 0;
 	u32 i, *ptr;
-	u8 *payload = firmware->payload;
+	u8 *payload;
 	int rc = 0;
+
+	if (size < sizeof(*firmware))
+		return -EINVAL;
+
 	firmware->start_address = le32_to_cpup((__le32 *)&firmware->start_address);
 	firmware->length = le32_to_cpup((__le32 *)&firmware->length);
+	payload_size = size - sizeof(*firmware);
+	if (firmware->length > payload_size)
+		return -EINVAL;
+
+	payload = firmware->payload;
+	size = firmware->length;
 
 	mem_address = firmware->start_address;
 
@@ -932,6 +943,11 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev,
 		return -ENOMEM;
 
 	if (coredev->mode != DEVICE_MODE_NONE) {
+		if (size < 24) {
+			rc = -EINVAL;
+			goto exit_fw_download;
+		}
+
 		pr_debug("sending reload command.\n");
 		SMS_INIT_MSG(&msg->x_msg_header, MSG_SW_RELOAD_START_REQ,
 			     sizeof(struct sms_msg_hdr));

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1