ASoC: SDCA: Ensure that Control Range is large enough for header

When reading the Ranges structure from an SDCA Control, ensure that the
read data is large enough to encompass the required header before
accessing it.

Fixes: 64fb5af1d1bb ("ASoC: SDCA: Add parsing for Control range structures")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260722103500.872714-5-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c
index 77940bd6b33c95d1151d1b0ec964146a2a766ea6..7a7a9f1a49389f1e17238c54fee2812b593f5c9a 100644 (file)
--- a/sound/soc/sdca/sdca_functions.c
+++ b/sound/soc/sdca/sdca_functions.c
@@ -855,6 +855,8 @@ static int find_sdca_control_range(struct device *dev,
                return 0;
        else if (num_range < 0)
                return num_range;
+       else if (num_range < 2 * sizeof(*limits))
+               return -EINVAL;
 
        range_list = devm_kcalloc(dev, num_range, sizeof(*range_list), GFP_KERNEL);
        if (!range_list)