diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-08-02 01:22:00 +0545 |
|---|---|---|
| committer | Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> | 2026-08-31 00:52:41 +0100 |
| commit | 1a7c522a35477d70320bd64aba8e9de0c1058c6f (patch) | |
| tree | 72189ae023dc74d0f0f7d6acf5371f0d96edb83a /tools/lib/python/kdoc/python_version.py | |
| parent | e787fd23d5063c61582c3c27522240b6e6703fde (diff) | |
| download | linux-next-1a7c522a35477d70320bd64aba8e9de0c1058c6f.tar.gz linux-next-1a7c522a35477d70320bd64aba8e9de0c1058c6f.zip | |
iio: proximity: aw96103: validate firmware data length
The firmware parser reads a length from the binary header and then uses
it to walk six-byte register/value entries. A truncated firmware image
can make the parser read beyond the copied firmware buffer. A value
smaller than the four-byte count field also underflows, producing a very
large length.
Read the little-endian field with get_unaligned_le32(), as previously
proposed by David Lechner. Validate the header size, reject an
underflowed length, ensure the resulting payload is contained in the
firmware image, and require it to contain whole register/value entries.
Fixes: 07b241262dca ("iio: proximity: aw96103: Add support for aw96103/aw96105 proximity sensor")
Link: https://lore.kernel.org/r/20260314-iio-proximity-aw96103-fix-firmware-read-v1-1-c74fe9ccd82b@baylibre.com
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions