diff options
author | Richard Fitzgerald <rf@opensource.cirrus.com> | 2022-04-12 17:39:27 +0100 |
---|---|---|
committer | Mark Brown <broonie@kernel.org> | 2022-04-12 17:57:04 +0100 |
commit | 5b933c7262c5b0ea11ea3c3b3ea81add04895954 (patch) | |
tree | 1e94e7eb10ac499ff298d646585ca7fd17d3fb35 /include/linux/swait_api.h | |
parent | ddfd534528146660de75ee84d6db10f10e778f95 (diff) |
firmware: cs_dsp: Fix overrun of unterminated control name string
For wmfw format v2 and later the coefficient name strings have a length
field and are NOT null-terminated. Use kasprintf() to convert the
unterminated string into a null-terminated string in an allocated buffer.
The previous code handled this duplication incorrectly using kmemdup()
and getting the length from a strlen() of the (unterminated) source string.
This resulted in creating a string that continued up to the next byte in
the firmware file that just happened to be 0x00.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs")
Link: https://lore.kernel.org/r/20220412163927.1303470-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'include/linux/swait_api.h')
0 files changed, 0 insertions, 0 deletions