[PATCH] memory: brcmstb_dpfe: validate firmware section sizes

[Pengpeng Hou]

__verify_firmware() reads a firmware header and sums declared
data and instruction section sizes with a trailing checksum.

Require the image to contain the header and checksum, and check each
declared section against the remaining firmware size before computing the
final total.

Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
---
 drivers/memory/brcmstb_dpfe.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 08d9e05b1b33..6846e3dac3d3 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -522,6 +522,9 @@ static int __verify_firmware(struct init_data *init,
 	bool is_big_endian = false;
 	const u32 *chksum_ptr;
 
+	if (fw->size < sizeof(*header) + sizeof(*chksum_ptr))
+		return ERR_INVALID_SIZE;
+
 	if (header->magic == DPFE_BE_MAGIC)
 		is_big_endian = true;
 	else if (header->magic != DPFE_LE_MAGIC)
@@ -539,6 +542,13 @@ static int __verify_firmware(struct init_data *init,
 	if ((dmem_size % sizeof(u32)) != 0 || (imem_size % sizeof(u32)) != 0)
 		return ERR_INVALID_SIZE;
 
+	if (dmem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr))
+		return ERR_INVALID_SIZE;
+
+	if (imem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr) -
+	    dmem_size)
+		return ERR_INVALID_SIZE;
+
 	/*
 	 * The header + the data section + the instruction section + the
 	 * checksum must be equal to the total firmware size.
-- 
2.43.0