linux/drivers/firmware
Richard Fitzgerald 5b933c7262
firmware: cs_dsp: Fix overrun of unterminated control name string
For wmfw format v2 and later the coefficient name strings have a length
field and are NOT null-terminated. Use kasprintf() to convert the
unterminated string into a null-terminated string in an allocated buffer.

The previous code handled this duplication incorrectly using kmemdup()
and getting the length from a strlen() of the (unterminated) source string.
This resulted in creating a string that continued up to the next byte in
the firmware file that just happened to be 0x00.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: f6bc909e76 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs")
Link: https://lore.kernel.org/r/20220412163927.1303470-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-04-12 17:57:04 +01:00
..
arm_ffa
arm_scmi
broadcom
cirrus
efi
google
imx
meson
psci
smccc
tegra
xilinx
Kconfig
Makefile
arm_scpi.c
arm_sdei.c
dmi-id.c
dmi-sysfs.c
dmi_scan.c
edd.c
iscsi_ibft.c
iscsi_ibft_find.c
memmap.c
pcdp.c
pcdp.h
qcom_scm-legacy.c
qcom_scm-smc.c
qcom_scm.c
qcom_scm.h
qemu_fw_cfg.c
raspberrypi.c
scpi_pm_domain.c
stratix10-rsu.c
stratix10-svc.c
sysfb.c
sysfb_simplefb.c
ti_sci.c
ti_sci.h
trusted_foundations.c
turris-mox-rwtm.c