firewire: core: validate sub-block lengths in fw_core_add_descriptor()

When traversing internal block structures of a descriptor in
fw_core_add_descriptor(), each sub-block header specifies its own length
in the upper 16 bits of its header quadlet.

If a malformed or corrupted descriptor provides a sub-block length that
exceeds the remaining total length of the descriptor buffer, the parsing
loop advances past the allocated boundary of desc->data, leading to an
out-of-bounds read access.

Validate each sub-block's length against the remaining descriptor size
before advancing the offset pointer to ensure loop bounds safety.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
Link: https://lore.kernel.org/r/20260725155255.3054-3-sreekuttan2156239@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>

0 files changed, 0 insertions, 0 deletions