[PATCH 2/3] ASoC: Intel: avs: Verify sizes of configs coming from topology

[Cezary Rojewski]

Before operating on the init_config or NHLT-blob entries check whether
their sizes are within bounds of the block being parsed.

Signed-off-by: Cezary Rojewski <cezary.rojewski@xxxxxxxxx>
---
 sound/soc/intel/avs/topology.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/intel/avs/topology.c b/sound/soc/intel/avs/topology.c
index 1085090d5a9c..e81401bb6dbd 100644
--- a/sound/soc/intel/avs/topology.c
+++ b/sound/soc/intel/avs/topology.c
@@ -1720,6 +1720,10 @@ static int avs_tplg_parse_initial_configs(struct snd_soc_component *comp,
 					       AVS_TKN_INIT_CONFIG_ID_U32,
 					       mod_init_config_parsers,
 					       ARRAY_SIZE(mod_init_config_parsers));
+		if (ret)
+			return ret;
+		if (config->length > block_size)
+			return -EINVAL;
 
 		block_size -= esize;
 
@@ -1790,6 +1794,8 @@ static int avs_tplg_parse_nhlt_configs(struct snd_soc_component *comp,
 		/* With tuples parsed, the blob shall be allocated. */
 		if (!config->blob)
 			return -EINVAL;
+		if (config->blob->capabilities_size > block_size)
+			return -EINVAL;
 
 		/* Consume the raw data and move to the next entry. */
 		memcpy(config->blob->capabilities, (u8 *)tuples + esize,
-- 
2.34.1