Skip to contentSkip to conversation

Input: elan_i2c - validate firmware size before use

PATCH New Dmitry Torokhov 1 participant 1 message Apr 26

Subsystems (2)
HID Input drivers
lore
Share & tools
lore

Dmitry Torokhov

author maintainer
#0 lore raw

PATCH 1/1 Input: elan_i2c - validate firmware size before use

Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before accessing them to prevent potential out-of-bounds reads.

Cc [email protected]
Signed-off-by Dmitry Torokhov <[email protected]>
---
 drivers/input/mouse/elan_i2c_core.c | 5 +++++
 1 file changed, 5 insertions(+)
drivers/input/mouse/elan_i2c_core.c +5 -0
index fee1796da3d0..74f822cd8774 100644
@@ -645,6 +645,11 @@ static ssize_t elan_sysfs_update_fw(struct device *dev,
 		return error;
 	}
 
+	if (fw->size < data->fw_signature_address + sizeof(signature)) {
+		dev_err(dev, "firmware file too small\n");
+		return -EBADF;
+	}
+
 	/* Firmware file must match signature data */
 	fw_signature = &fw->data[data->fw_signature_address];
 	if (memcmp(fw_signature, signature, sizeof(signature)) != 0) {
Signature · 5 lines
2.54.0.545.g6539524ca2-goog


-- 
Dmitry