wifi: rtw89: fw: safely cast mfw_hdr pointer from firmware->data

Browse source

Check size of struct mfw_hdr within firmware->size before type casting
to ensure to validly dereference fields from mfm_hdr pointer. Then,
check if signature field is equal to RTW89_MFW_SIG to assert current
is multi-firmware.

Addresses-Coverity-ID: 1494046 ("Untrusted loop bound")
Addresses-Coverity-ID: 1544385 ("Untrusted array index read")

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250217064308.43559-6-pkshih@realtek.com

...

This commit is contained in:

Ping-Ke Shih 2025-02-17 14:43:08 +08:00

parent dc2fc1a341

commit e072210330

1 changed files with 24 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

30

drivers/net/wireless/realtek/rtw89/fw.c

View file