Skip to content

tplg_parser: reject process priv blob smaller than abi header#10939

Open
jmestwa-coder wants to merge 1 commit into
thesofproject:mainfrom
jmestwa-coder:tplg-process-priv-bound
Open

tplg_parser: reject process priv blob smaller than abi header#10939
jmestwa-coder wants to merge 1 commit into
thesofproject:mainfrom
jmestwa-coder:tplg-process-priv-bound

Conversation

@jmestwa-coder

Copy link
Copy Markdown
Contributor

Integer underflow in the topology process-widget parser:

  • process_append_data3 subtracts the 32-byte ABI header from the host-supplied priv.size as a size_t
  • a bytes control with priv.size below that underflows size; the ipc_size check wraps along with it and passes, so the memcpy overruns process_ipc
  • process_append_data4 right below is unaffected, it bounds the subtracted size directly

Reject priv.size below sizeof(struct sof_abi_hdr) before the subtraction.

process_append_data3() subtracts sizeof(struct sof_abi_hdr) from the
host-supplied priv.size as a size_t. A bytes control declaring priv.size
below the ABI header underflows size, and the ipc_size check wraps along
with it and passes, so the memcpy overruns process_ipc. Reject the
undersized blob before the subtraction.

Signed-off-by: jmestwa-coder <jmestwa@gmail.com>
@sofci

sofci commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator

Can one of the admins verify this patch?

reply test this please to run this test once

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes an integer underflow in the IPC3 process-widget private data handling in the topology parser by rejecting priv.size values smaller than the ABI header before subtracting sizeof(struct sof_abi_hdr).

Changes:

  • Add an early validation in process_append_data3() to reject bytes_ctl->priv.size < sizeof(struct sof_abi_hdr) and return -EINVAL.
  • Prevent size_t underflow that could otherwise bypass the existing ipc_size > max_process_size check and lead to an out-of-bounds memcpy().

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants