diff options
| author | Adrian Korwel <adriank20047@gmail.com> | 2026-05-25 09:58:32 -0500 |
|---|---|---|
| committer | Johan Hovold <johan@kernel.org> | 2026-06-02 12:09:25 +0200 |
| commit | 0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae (patch) | |
| tree | d91a13b69e4bc8119ac87647a9821ecde524eb35 /drivers/usb | |
| parent | 183c1076eca43bbb3e7bdf597456f91d81c73e74 (diff) | |
| download | linux-next-0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae.tar.gz linux-next-0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae.zip | |
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
build_i2c_fw_hdr() allocates a fixed-size buffer of
(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then
copies le16_to_cpu(img_header->Length) bytes into it without
validating that Length fits within the available space after the
firmware record header.
img_header->Length is a __le16 from the firmware file and can be
up to 65535. check_fw_sanity() validates the total firmware size
but not img_header->Length specifically.
Fix by rejecting images where img_header->Length exceeds the
available destination space.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/serial/io_ti.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c index 6e0d4c38911b..d48819d785ef 100644 --- a/drivers/usb/serial/io_ti.c +++ b/drivers/usb/serial/io_ti.c @@ -844,6 +844,11 @@ static int build_i2c_fw_hdr(u8 *header, const struct firmware *fw) /* Pointer to fw_down memory image */ img_header = (struct ti_i2c_image_header *)&fw->data[4]; + if (le16_to_cpu(img_header->Length) > + buffer_size - sizeof(struct ti_i2c_firmware_rec)) { + kfree(buffer); + return -EINVAL; + } memcpy(buffer + sizeof(struct ti_i2c_firmware_rec), &fw->data[4 + sizeof(struct ti_i2c_image_header)], le16_to_cpu(img_header->Length)); |