ipc: header size validation fix

This patch will deny IPC headers with size 0 Signed-off-by: Adrian Bonislawski <adrian.bonislawski@linux.intel.com>
thesofproject · Jun 5, 2020 · 88707ca · 88707ca
1 parent 6581428
commit 88707ca
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/ipc/handler.c b/src/ipc/handler.c
@@ -121,8 +121,8 @@ struct sof_ipc_cmd_hdr *mailbox_validate(void)
 	mailbox_hostbox_read(hdr, SOF_IPC_MSG_MAX_SIZE, 0, sizeof(*hdr));
 
 	/* validate component header */
-	if (hdr->size > SOF_IPC_MSG_MAX_SIZE) {
-		trace_ipc_error("ipc: msg too big at 0x%x", hdr->size);
+	if (hdr->size < sizeof(*hdr) || hdr->size > SOF_IPC_MSG_MAX_SIZE) {
+		trace_ipc_error("ipc: invalid size 0x%x", hdr->size);
 		return NULL;
 	}