[PATCH] thunderbolt: validate DROM entry lengths

[Pengpeng Hou <pengpeng@iscas.ac.cn>]

From: Pengpeng <pengpeng@iscas.ac.cn>

tb_drom_parse_entries() checks that a DROM entry does not run past the
end of the DROM, but it did not require the declared entry length to
cover the entry header itself.

Require each entry to contain its two-byte header before dispatching to
the type-specific DROM entry parsers.

Signed-off-by: Pengpeng <pengpeng@iscas.ac.cn>
---
 drivers/thunderbolt/eeprom.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 5681c17f82ec..270bb34aff42 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -414,9 +414,15 @@ static int tb_drom_parse_entries(struct tb_switch *sw, size_t header_size)
 	int res;
 
 	while (pos < drom_size) {
-		struct tb_drom_entry_header *entry = (void *) (sw->drom + pos);
-		if (pos + 1 == drom_size || pos + entry->len > drom_size
-				|| !entry->len) {
+		struct tb_drom_entry_header *entry;
+
+		if (drom_size - pos < sizeof(*entry)) {
+			tb_sw_warn(sw, "DROM buffer overrun\n");
+			return -EIO;
+		}
+
+		entry = (void *)(sw->drom + pos);
+		if (entry->len < sizeof(*entry) || entry->len > drom_size - pos) {
 			tb_sw_warn(sw, "DROM buffer overrun\n");
 			return -EIO;
 		}
-- 
2.43.0