]> www.infradead.org Git - users/jedix/linux-maple.git/commit
wifi: rtw89: fw: safely cast mfw_hdr pointer from firmware->data
authorPing-Ke Shih <pkshih@realtek.com>
Mon, 17 Feb 2025 06:43:08 +0000 (14:43 +0800)
committerPing-Ke Shih <pkshih@realtek.com>
Fri, 21 Feb 2025 01:51:43 +0000 (09:51 +0800)
commite0722103306fd5fd3cdde8d100a7588bfe7abdf0
tree6c5520f0bdd20ab7b5695064debaf8315c89e8d2
parentdc2fc1a3419e9218fde6e7897c8c238ebe75a69e
wifi: rtw89: fw: safely cast mfw_hdr pointer from firmware->data

Check size of struct mfw_hdr within firmware->size before type casting
to ensure to validly dereference fields from mfm_hdr pointer. Then,
check if signature field is equal to RTW89_MFW_SIG to assert current
is multi-firmware.

Addresses-Coverity-ID: 1494046 ("Untrusted loop bound")
Addresses-Coverity-ID: 1544385 ("Untrusted array index read")

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250217064308.43559-6-pkshih@realtek.com
drivers/net/wireless/realtek/rtw89/fw.c