fpga: xilinx: Check bitstream length against the supplied buffer

fpga_loadbitstream() receives a size argument describing the length of
the caller's buffer but never uses it. All header offsets are read from
the bitstream, including the 32-bit data length at tag 0x65, which is
passed to fpga_load() unmodified and becomes the DMA transfer length.
A header declaring more data than the caller supplied makes the DMA
read beyond the end of the buffer.

Reject the bitstream if its header and the data it declares do not
fit within size.

Fixes: c26acc1a43b3 ("Remove bit swapping in Xilinx Spartan bitfile loading")
Signed-off-by: Pranav Tilak <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://patch.msgid.link/[email protected]

0 files changed, 0 insertions, 0 deletions