ASoC: SOF: amd: sanity-check decoded ACP7 signed firmware length

After reading SizeFWSigned and adding the header size, the resulting
length must be non-zero and must not exceed the firmware buffer we were
given. Reject corrupt headers or truncated images before starting SHA
DMA.

Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>

Author: vijendarmukunda

sound/soc/sof/amd/acp-loader.c

@@ -184,6 +184,11 @@ int acp_dsp_pre_fw_run(struct snd_sof_dev *sdev)
 			size_fw = get_unaligned_le32(adata->bin_buf +
 						     ACP_IMAGE_HDR_SIZE_FW_SIGNED_OFF);
 			size_fw += ACP_IMAGE_HEADER_SIZE;
+			if (!size_fw || size_fw > adata->fw_bin_size) {
+				dev_err(sdev->dev, "Invalid signed firmware header size %u (max %u)\n",
+					size_fw, adata->fw_bin_size);
+				return -EINVAL;
+			}
 		} else {
 			size_fw = adata->fw_bin_size;
 		}