DF-5238
cxm_enc_fw: encoder firmware download loop bounded by hardcoded CXM_FW_SIZE (256 KiB), not the actual object size — latent kernel-rodata OOB read if an under-length firmware blob is compiled in (twin of the dec_fw finding)
Summary
Byte-identical twin modulo symbol: NOFW stub, unsized extern, hardcoded CXM_FW_SIZE copy at cxm.c:681-683. Dead code on stock builds (attach fails ENXIO); wrong-length blob = adjacent-rodata OOB into card encoder SDRAM. Same export-size fix shape; twin DF-5237.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5238 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
per-fix-DF-5238
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace: unsized extern + hardcoded CXM_FW_SIZE loop (cxm.c:681-689)
Verified recommended fix
export fw size symbol + refuse size != CXM_FW_SIZE before copy
Verdict
untested (Info build-time hazard; requires Conexant HW + hand-built wrong-size fw blob)
No comments yet.