[PATCH 08/16] ASoC: SOF: amd: require full ACP header for ACP7 signed firmware

ACP7.B/7.F signed images read SizeFWSigned from a fixed offset inside
the ACP header. Reject firmware buffers shorter than the header so we
never read past the end of the supplied image.

Signed-off-by: Vijendar Mukunda <[email protected]>
Reviewed-by: Bard Liao <[email protected]>
---
 sound/soc/sof/amd/acp-loader.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sound/soc/sof/amd/acp-loader.c b/sound/soc/sof/amd/acp-loader.c
index af04f053fd65..e4a17e6656c0 100644
--- a/sound/soc/sof/amd/acp-loader.c
+++ b/sound/soc/sof/amd/acp-loader.c
@@ -176,6 +176,11 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev)
 
 	if (adata->pci_rev >= ACP7B_PCI_ID) {
 		if (adata->acp_sof_signed_firmware_image) {
+			if (adata->fw_bin_size <= ACP_IMAGE_HEADER_SIZE) {
+				dev_err(sdev->dev, "Invalid signed firmware size %u\n",
+					adata->fw_bin_size);
+				return -EINVAL;
+			}
 			size_fw = get_unaligned_le32(adata->bin_buf +
 						     ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF);
 			size_fw += ACP_IMAGE_HEADER_SIZE;
-- 
2.45.2