OrgACRN
/
sof
mirror of https://github.com/thesofproject/sof.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

manifest.c: assert buffer overflow in man_copy_sram() 

Does not solve https://github.com/thesofproject/sof/issues/3423 but
converts a buffer overflow and crash into a more usable assert.

Buffer overflow found by running rimage with valgrind and the binaries
provided by @singalsu

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
This commit is contained in:
Marc Herbert 2020-10-15 07:03:10 +00:00
parent fccf521331
commit 7322c02349
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/manifest.c
View File

@ -167,6 +167,8 @@ static int man_copy_sram(struct image *image, Elf32_Shdr *section,
void *buffer = image->fw_image + offset; void *buffer = image->fw_image + offset;
size_t count; size_t count;
assert((uint64_t)offset + section->size <= image->adsp->image_size);
switch (section->type) { switch (section->type) {
case SHT_INIT_ARRAY: case SHT_INIT_ARRAY:
/* fall through */ /* fall through */