firewire: core: validate sub-block lengths in fw_core_add_descriptor()

Browse source

When traversing internal block structures of a descriptor in
fw_core_add_descriptor(), each sub-block header specifies its own length
in the upper 16 bits of its header quadlet.

If a malformed or corrupted descriptor provides a sub-block length that
exceeds the remaining total length of the descriptor buffer, the parsing
loop advances past the allocated boundary of desc->data, leading to an
out-of-bounds read access.

Validate each sub-block's length against the remaining descriptor size
before advancing the offset pointer to ensure loop bounds safety.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
Link: https://lore.kernel.org/r/20260725155255.3054-3-sreekuttan2156239@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>

...

This commit is contained in:

Sreeraj S Kurup 2026-07-25 15:52:55 +00:00 • committed by Takashi Sakamoto

parent e8e659f791

commit a5367912ba

1 changed files with 18 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

20

drivers/firewire/core-card.c

View file