[PATCH] fpga: xilinx: Check bitstream length against the supplied buffer

fpga_loadbitstream() receives a size argument describing the length of
the caller's buffer but never uses it. All header offsets are read from
the bitstream, including the 32-bit data length at tag 0x65, which is
passed to fpga_load() unmodified and becomes the DMA transfer length.
A header declaring more data than the caller supplied makes the DMA
read beyond the end of the buffer.

Reject the bitstream if its header and the data it declares do not
fit within size.

Fixes: c26acc1a43b3 ("Remove bit swapping in Xilinx Spartan bitfile loading")
Signed-off-by: Pranav Tilak <[email protected]>
---
 drivers/fpga/xilinx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/fpga/xilinx.c b/drivers/fpga/xilinx.c
index b6966c7d2cb..c0f8e61f9bf 100644
--- a/drivers/fpga/xilinx.c
+++ b/drivers/fpga/xilinx.c
@@ -44,6 +44,7 @@ int fpga_loadbitstream(int devnum, char *fpgadata, size_t size,
 	unsigned int length;
 	unsigned int swapsize;
 	unsigned char *dataptr;
+	unsigned long hdrlen;
 	unsigned int i;
 	const fpga_desc *desc;
 	xilinx_desc *xdesc;
@@ -143,6 +144,14 @@ int fpga_loadbitstream(int devnum, char *fpgadata, size_t size,
 	dataptr += 4;
 	printf("  bytes in bitstream = %d\n", swapsize);
 
+	/* Make sure the header and data fit in the caller's buffer */
+	hdrlen = (unsigned long)dataptr - (unsigned long)fpgadata;
+	if (hdrlen > size || swapsize > size - hdrlen) {
+		printf("%s: Bitstream does not fit in %lu byte buffer\n",
+		       __func__, (unsigned long)size);
+		return FPGA_FAIL;
+	}
+
 	return fpga_load(devnum, dataptr, swapsize, bstype, 0);
 }
 
-- 
2.43.0