summaryrefslogtreecommitdiff
path: root/drivers/firmware/google/vpd.c
diff options
context:
space:
mode:
authorHung-Te Lin <hungte@chromium.org>2019-08-30 10:23:58 +0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-09-04 13:31:28 +0200
commit4b708b7b1a2c09fbdfff6b942ebe3a160213aacd (patch)
treead31afbed490493fd166202be7d4dba3f8a14ad1 /drivers/firmware/google/vpd.c
parent8619e5bdeee8b2c685d686281f2d2a6017c4bc15 (diff)
downloadlinux-sh-4b708b7b1a2c09fbdfff6b942ebe3a160213aacd.tar.gz
firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to parse data from untrusted input without checking if the meta data is invalid or corrupted. For example, the size from decoded content may be negative value, or larger than whole input buffer. Such invalid data may cause buffer overflow. To fix that, the size parameters passed to vpd_decode functions should be changed to unsigned integer (u32) type, and the parsing of entry header should be refactored so every size field is correctly verified before starting to decode. Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files") Signed-off-by: Hung-Te Lin <hungte@chromium.org> Cc: stable <stable@vger.kernel.org> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/firmware/google/vpd.c')
-rw-r--r--drivers/firmware/google/vpd.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;