diff options
| author | Sreeraj S Kurup <sreekuttan2156239@gmail.com> | 2026-07-25 15:52:54 +0000 |
|---|---|---|
| committer | Takashi Sakamoto <o-takashi@sakamocchi.jp> | 2026-07-27 09:39:52 +0900 |
| commit | e8e659f79178c3c30bbfbfac7a310a2a27c9694b (patch) | |
| tree | ef7dd2409ce70ec72b758837138c397ae0bdde55 /scripts/objdiff | |
| parent | f5098b6bae761e346ebcd9da7f95622c04733cff (diff) | |
| download | linux-e8e659f79178c3c30bbfbfac7a310a2a27c9694b.tar.gz linux-e8e659f79178c3c30bbfbfac7a310a2a27c9694b.zip | |
firewire: core: validate overall descriptor length in fw_core_add_descriptor()
In fw_core_add_descriptor(), incoming descriptor structures are processed
without checking whether the descriptor's specified length falls within
valid boundaries. An empty descriptor (length 0) or an oversized descriptor
exceeding the IEEE 1394 Config ROM capacity can lead to invalid processing.
Add bounds checking at the start of fw_core_add_descriptor() using the
in_range() helper macro to reject descriptors with length 0 or length
exceeding 256 quadlets (the standard maximum Configuration ROM size).
Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
Link: https://lore.kernel.org/r/20260725155255.3054-2-sreekuttan2156239@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions