]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ASoC: tas2781: bound firmware description string parsing
authorPengpeng Hou <pengpeng@iscas.ac.cn>
Mon, 6 Jul 2026 14:45:39 +0000 (22:45 +0800)
committerMark Brown <broonie@kernel.org>
Tue, 14 Jul 2026 11:24:23 +0000 (12:24 +0100)
commitbc889dfcea9294a1eae7f8e2f3573a90764ae4d0
tree2f4966951b37d2c6a5cc88fdf7ecbb447ffde917
parent27d090f3ccd4cade897fb7e0c8c0a6e2fd3a95a0
ASoC: tas2781: bound firmware description string parsing

The TAS2781 firmware parser reads several variable-length description
strings with strlen() before checking that the string terminator is
present inside the firmware blob. A malformed firmware image without a
NUL terminator can therefore make the parser walk past the end of the
firmware buffer before the later size checks run.

Add a small bounded string-length helper and use it for all description
fields that are parsed from the firmware buffer. Keep the existing size
checks for the fixed bytes that follow each string.

Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706144540.93929-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/codecs/tas2781-fmwlib.c