diff options
| author |   Lars-Peter Clausen <lars@metafoo.de> | 2011-11-28 09:44:15 +0100 |
|---|---|---|
| committer |   Mark Brown <broonie@opensource.wolfsonmicro.com> | 2011-11-29 11:59:44 +0000 |
| commit | c56935bdc0a8edf50237d3b0205133a5b0adc604 (patch) | |
| tree | 0520283ac825f78162cb674e79d85e6fb60f76f0 /drivers/firmware | |
| parent | firmware: Sigma: Prevent out of bounds memory access (diff) | |
| download | linux-dev-c56935bdc0a8edf50237d3b0205133a5b0adc604.tar.xz linux-dev-c56935bdc0a8edf50237d3b0205133a5b0adc604.zip | |
firmware: Sigma: Skip header during CRC generation
The firmware header is not part of the CRC, so skip it. Otherwise the firmware
will be rejected due to non-matching CRCs.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@kernel.org
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/sigma.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/firmware/sigma.c b/drivers/firmware/sigma.c index c780baa59ed9..36265de0a9e8 100644 --- a/drivers/firmware/sigma.c +++ b/drivers/firmware/sigma.c @@ -130,7 +130,8 @@ int process_sigma_firmware(struct i2c_client *client, const char *name) if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic))) goto done; - crc = crc32(0, fw->data, fw->size); + crc = crc32(0, fw->data + sizeof(*ssfw_head), + fw->size - sizeof(*ssfw_head)); pr_debug("%s: crc=%x\n", __func__, crc); if (crc != ssfw_head->crc) goto done; |