[PATCH] ASoC: SOF: ipc3: bound firmware-supplied ext header size

[Ștefan Ghețu]

ext_hdr->hdr.size comes straight from firmware and is used unchecked
as a read length: too large overflows the PAGE_SIZE heap allocation
in ext_data, too small underflows the size_t subtraction (hdr.size -
sizeof(*ext_hdr)), producing a read length near SIZE_MAX.

Bound hdr.size to [sizeof(*ext_hdr), PAGE_SIZE] before using it.

Signed-off-by: Ștefan Ghețu <stefanghetu9@xxxxxxxxx>
---
 sound/soc/sof/ipc3.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c
index 85bb22bbe18d..6188e43726e2 100644
--- a/sound/soc/sof/ipc3.c
+++ b/sound/soc/sof/ipc3.c
@@ -598,6 +598,14 @@ static int ipc3_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 offset)
 	ext_hdr = ext_data;
 
 	while (ext_hdr->hdr.cmd == SOF_IPC_FW_READY) {
+		/* bound hdr.size to avoid heap overflow/underflow */
+		if (ext_hdr->hdr.size < sizeof(*ext_hdr) ||
+		   ext_hdr->hdr.size > PAGE_SIZE) {
+			dev_err(sdev->dev, "invalid ext data size 0x%x\n",
+				ext_hdr->hdr.size);
+			ret = -EINVAL;
+			break;
+		}
 		/* read in ext structure */
 		snd_sof_dsp_block_read(sdev, SOF_FW_BLK_TYPE_SRAM,
 				       offset + sizeof(*ext_hdr),
-- 
2.53.0