[PATCH 09/16] ASoC: SOF: amd: validate SizeFWSigned before signed FW length on ACP7x

The ACP7.B/7.F ACPI signed path already reads SizeFWSigned from the image
header into size_fw. Before adding ACP_IMAGE_HEADER_SIZE for SHA DMA,
reject payload size zero or any size_fw with size_fw > fw_bin_size -
ACP_IMAGE_HEADER_SIZE, so size_fw + ACP_IMAGE_HEADER_SIZE cannot exceed the
supplied firmware buffer.

Signed-off-by: Vijendar Mukunda <[email protected]>
Reviewed-by: Bard Liao <[email protected]>
---
 sound/soc/sof/amd/acp-loader.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/sof/amd/acp-loader.c b/sound/soc/sof/amd/acp-loader.c
index e4a17e6656c0..76335c78255f 100644
--- a/sound/soc/sof/amd/acp-loader.c
+++ b/sound/soc/sof/amd/acp-loader.c
@@ -183,6 +183,13 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev)
 			}
 			size_fw = get_unaligned_le32(adata->bin_buf +
 						     ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF);
+			if (!size_fw ||
+			    size_fw > adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE) {
+				dev_err(sdev->dev,
+					"Invalid signed firmware payload size %u (max %u)\n",
+					size_fw, adata->fw_bin_size - ACP_IMAGE_HEADER_SIZE);
+				return -EINVAL;
+			}
 			size_fw += ACP_IMAGE_HEADER_SIZE;
 		} else {
 			size_fw = adata->fw_bin_size;
-- 
2.45.2