module_adapter: ipc4: validate pin counts against IPC4 maximum

abonislawski · kv2019i · commit c3511935563a · 2026-05-19T22:29:03.000+03:00
Reject IPC4 module init payloads where nb_input_pins or nb_output_pins
exceed the protocol maximum (IPC4_MAX_SRC_QUEUE / IPC4_MAX_DST_QUEUE = 8).

The existing cfgsz equality check ensures the immediate pointer
arithmetic is in-bounds, but it does not prevent unsupported pin counts
from being stored in dst-&gt;nb_input_pins / dst-&gt;nb_output_pins and used
by downstream module code. Add explicit upper-bound validation before
computing pinsz, matching the IPC4 ABI contract advertised via
IPC4_MAX_MODULE_PIN_COUNT_FW_CFG.

Signed-off-by: Adrian Bonislawski &lt;adrian.bonislawski@intel.com&gt;
diff --git a/src/audio/module_adapter/module_adapter_ipc4.c b/src/audio/module_adapter/module_adapter_ipc4.c
@@ -21,6 +21,7 @@
 #include <sof/ut.h>
 #include <rtos/interrupt.h>
 #include <rtos/symbol.h>
+#include <ipc4/base_fw.h>
 #include <limits.h>
 #include <stdint.h>
 
@@ -162,6 +163,9 @@ int module_adapter_init_data(struct comp_dev *dev,
 			     + (n_out * sizeof(*dst->output_pins));
 
 		if (cfgsz == (sizeof(*cfg) + pinsz)) {
+			if (n_in > IPC4_MAX_SRC_QUEUE || n_out > IPC4_MAX_DST_QUEUE)
+				return -EINVAL;
+
 			dst->nb_input_pins = n_in;
 			dst->nb_output_pins = n_out;
 			dst->input_pins = sof_heap_alloc(dev->mod->priv.resources.alloc->heap,
