lkml.org 
[lkml]   [2011]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 1/8] firmware: Sigma: Prevent out of bounds memory access
Date
On Thursday 24 November 2011 07:48:20 Lars-Peter Clausen wrote:
> The SigmaDSP firmware loader currently does not perform enough boundary
> size checks when processing the firmware. As a result it is possible that
> a malformed firmware can cause an out of bounds memory access.
>
> This patch adds checks which ensure that both the action header and the
> payload are completely inside the firmware data boundaries before
> processing them.

in general this looks fine ...

> --- a/drivers/firmware/sigma.c
> +++ b/drivers/firmware/sigma.c
>
> -/* Return: 0==OK, <0==error, =1 ==no more actions */
> static int
> +process_sigma_action(struct i2c_client *client, struct
> sigma_action *sa)

looks like you're inverting the semantics of this func. i'd add an updated
comment above the func to document the new return values.

> + /* Reject too small or unreasonable large files. The upper limit is
> + * chosen a bit arbitrarily but it should be enough for all practical
> + * purposes and having the limit makes it easier to avoid integer
> + * overflows later in the loading process. */

multi-line comment style:
/*
* line one
* line two
*/
-mike
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2011-11-24 18:29    [W:0.716 / U:0.340 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site