summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorRichard Fitzgerald <rf@opensource.cirrus.com>2022-04-12 19:39:27 +0300
committerMark Brown <broonie@kernel.org>2022-04-12 19:57:04 +0300
commit5b933c7262c5b0ea11ea3c3b3ea81add04895954 (patch)
tree1e94e7eb10ac499ff298d646585ca7fd17d3fb35 /sound
parentddfd534528146660de75ee84d6db10f10e778f95 (diff)
downloadlinux-5b933c7262c5b0ea11ea3c3b3ea81add04895954.tar.xz
firmware: cs_dsp: Fix overrun of unterminated control name string
For wmfw format v2 and later the coefficient name strings have a length field and are NOT null-terminated. Use kasprintf() to convert the unterminated string into a null-terminated string in an allocated buffer. The previous code handled this duplication incorrectly using kmemdup() and getting the length from a strlen() of the (unterminated) source string. This resulted in creating a string that continued up to the next byte in the firmware file that just happened to be 0x00. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") Link: https://lore.kernel.org/r/20220412163927.1303470-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
0 files changed, 0 insertions, 0 deletions