From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001ae601.pphosted.com ([67.231.152.168]:43958 "EHLO mx0b-001ae601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753129AbdLHJga (ORCPT ); Fri, 8 Dec 2017 04:36:30 -0500 Date: Fri, 8 Dec 2017 09:36:19 +0000 From: Charles Keepax To: Ben Hutchings CC: Charles Keepax , Richard Fitzgerald , , , Subject: Re: [PATCH] ASoC: wm_adsp: Fix validation of firmware and coeff lengths Message-ID: <20171208093619.jtnuvjfmane4ezas@localhost.localdomain> References: <20171207211928.btwtwlfci6f4hku2@xylophone.i.decadent.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: <20171207211928.btwtwlfci6f4hku2@xylophone.i.decadent.org.uk> Sender: stable-owner@vger.kernel.org List-ID: On Thu, Dec 07, 2017 at 09:19:29PM +0000, Ben Hutchings wrote: > The checks for whether another region/block header could be present > are subtracting the size from the current offset. Obviously we should > instead subtract the offset from the size. > > The checks for whether the region/block data fit in the file are > adding the data size to the current offset and header size, without > checking for integer overflow. Rearrange these so that overflow is > impossible. > > Cc: stable@vger.kernel.org > Signed-off-by: Ben Hutchings > --- Acked-by: Charles Keepax Tested-by: Charles Keepax But you would probably be best to resend and include Mark Brown in the To: field. He applies the Wolfson patches directly to his tree and he might miss it since it just went to the list. Thanks, Charles