From 7ad6c23121df528fcb73a47ba38d0eaec1a8f213 Mon Sep 17 00:00:00 2001
From: Bartosz Kokoszko <bartoszx.kokoszko@linux.intel.com>
Date: Thu, 11 Oct 2018 11:34:14 +0200
Subject: [PATCH] rmbox: fix rmbox KW issues

Signed-off-by: Bartosz Kokoszko <bartoszx.kokoszko@linux.intel.com>
---
 rmbox/logger_convert.c | 29 +++++++++++++++++++++++++++--
 rmbox/rmbox.c          |  2 +-
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/rmbox/logger_convert.c b/rmbox/logger_convert.c
index 7156b61ad..e54f3d535 100644
--- a/rmbox/logger_convert.c
+++ b/rmbox/logger_convert.c
@@ -24,6 +24,10 @@
 
 #define CEIL(a, b) ((a+b-1)/b)
 
+#define TRACE_MAX_PARAMS_COUNT		4
+#define TRACE_MAX_TEXT_LEN		1024
+#define TRACE_MAX_FILENAME_LEN		128
+
 /* logs file signature */
 #define SND_SOF_LOGS_SIG_SIZE	4
 #define SND_SOF_LOGS_SIG	"Logs"
@@ -172,8 +176,13 @@ static int fetch_entry(struct convert_config *config, uint32_t base_address,
 		ret = -ferror(config->ldc_fd);
 		goto out;
 	}
-
+	if (entry.header.file_name_len > TRACE_MAX_FILENAME_LEN) {
+		fprintf(stderr, "Error: Invalid filename length. \n");
+		ret = -EINVAL;
+		goto out;
+	}
 	entry.file_name = (char *)malloc(entry.header.file_name_len);
+
 	if (!entry.file_name) {
 		fprintf(stderr, "error: can't allocate %d byte for "
 			"entry.file_name\n", entry.header.file_name_len);
@@ -200,6 +209,11 @@ static int fetch_entry(struct convert_config *config, uint32_t base_address,
 	}
 
 	/* fetching text */
+	if (entry.text_len > TRACE_MAX_TEXT_LEN) {
+		fprintf(stderr, "Error: Invalid text length. \n");
+		ret = -EINVAL;
+		goto out;
+	}
 	entry.text = (char *)malloc(entry.text_len);
 	if (entry.text == NULL) {
 		fprintf(stderr, "error: can't allocate %d byte for "
@@ -207,7 +221,6 @@ static int fetch_entry(struct convert_config *config, uint32_t base_address,
 		ret = -ENOMEM;
 		goto out;
 	}
-
 	ret = fread(entry.text, sizeof(char), entry.text_len, config->ldc_fd);
 	if (ret != entry.text_len) {
 		ret = -ferror(config->ldc_fd);
@@ -215,8 +228,20 @@ static int fetch_entry(struct convert_config *config, uint32_t base_address,
 	}
 
 	/* fetching entry params from dma dump */
+	if (entry.header.params_num > TRACE_MAX_PARAMS_COUNT) {
+		fprintf(stderr, "Error: Invalid number of parameters. \n");
+		ret = -EINVAL;
+		goto out;
+	}
 	entry.params = (uint32_t *)malloc(sizeof(uint32_t) *
 		entry.header.params_num);
+	if (entry.params == NULL) {
+		fprintf(stderr, "error: can't allocate %d byte for "
+			"entry.params\n", (int)(sizeof(uint32_t) *
+			entry.header.params_num));
+		ret = -ENOMEM;
+		goto out;
+	}
 	ret = fread(entry.params, sizeof(uint32_t), entry.header.params_num,
 		config->in_fd);
 	if (ret != entry.header.params_num) {
diff --git a/rmbox/rmbox.c b/rmbox/rmbox.c
index 671a2d1be..6a53be74f 100644
--- a/rmbox/rmbox.c
+++ b/rmbox/rmbox.c
@@ -214,7 +214,7 @@ int main(int argc, char *argv[])
 
 out:
 	/* close files */
-	if (config.out_file)
+	if (config.out_fd)
 		fclose(config.out_fd);
 
 	if (config.in_fd)