Skip to content

Commit 28b97ca

Browse files
committed
audio: mixin_mixout: check sink_get_buffer() return value
sink_get_buffer() can return -EBUSY or -ENODATA without writing its output parameters, so using buf_size right after the call read an uninitialized value and built an invalid buffer end pointer. Check the return value and bail out on error in both mixout_process() and the sibling mixin_process() acquire path, releasing already-acquired source data on the mixin path. Signed-off-by: Adrian Bonislawski <adrian.bonislawski@intel.com>
1 parent 0f9fa75 commit 28b97ca

1 file changed

Lines changed: 13 additions & 5 deletions

File tree

src/audio/mixin_mixout/mixin_mixout.c

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -458,8 +458,13 @@ static int mixin_process(struct processing_module *mod,
458458
size_t free_bytes = sink_get_free_size(sink);
459459
size_t buf_size;
460460

461-
sink_get_buffer(sink, free_bytes, &mixout_data->acquired_buf.ptr,
462-
&mixout_data->acquired_buf.buf_start, &buf_size);
461+
ret = sink_get_buffer(sink, free_bytes, &mixout_data->acquired_buf.ptr,
462+
&mixout_data->acquired_buf.buf_start, &buf_size);
463+
if (ret < 0) {
464+
if (bytes_to_consume)
465+
source_release_data(sources[0], 0);
466+
return ret;
467+
}
463468
mixout_data->acquired_buf.buf_end =
464469
(uint8_t *)mixout_data->acquired_buf.buf_start + buf_size;
465470
mixout_data->acquired_buf_free_frames =
@@ -513,7 +518,7 @@ static int mixout_process(struct processing_module *mod,
513518
uint32_t frames_to_produce = INT32_MAX;
514519
uint32_t bytes_to_produce;
515520
struct pending_frames *pending_frames;
516-
int i;
521+
int i, ret;
517522

518523
comp_dbg(dev, "entry");
519524

@@ -574,8 +579,11 @@ static int mixout_process(struct processing_module *mod,
574579
if (!md->acquired_buf.ptr) {
575580
size_t buf_size;
576581

577-
sink_get_buffer(sinks[0], bytes_to_produce, &md->acquired_buf.ptr,
578-
&md->acquired_buf.buf_start, &buf_size);
582+
ret = sink_get_buffer(sinks[0], bytes_to_produce, &md->acquired_buf.ptr,
583+
&md->acquired_buf.buf_start, &buf_size);
584+
if (ret < 0)
585+
return ret;
586+
579587
md->acquired_buf.buf_end = (uint8_t *)md->acquired_buf.buf_start + buf_size;
580588
}
581589

0 commit comments

Comments
 (0)