Skip to content

Commit f746543

Browse files
committed
cadence: validate init payload covers the direction field
The init path read the direction word at a fixed offset past the codec params without checking the payload was large enough, reading past the mailbox. Require the payload to cover the field. Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
1 parent 3f7738d commit f746543

1 file changed

Lines changed: 16 additions & 2 deletions

File tree

src/audio/module_adapter/module/cadence_ipc4.c

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,16 @@ static int cadence_codec_init(struct processing_module *mod)
245245
if (codec->state == MODULE_DISABLED && ext_data->module_data_size > 0) {
246246
int size = ext_data->module_data_size;
247247
uint8_t *init_bytes;
248+
uint32_t direction;
249+
250+
/* the init payload holds the codec params followed by the
251+
* direction word; validate the size up front before using it
252+
*/
253+
if (size < (int)(sizeof(struct snd_codec) + sizeof(uint32_t))) {
254+
comp_err(dev, "setup config too small: %d", size);
255+
ret = -EINVAL;
256+
goto free_cd;
257+
}
248258

249259
setup_cfg = &cd->setup_cfg;
250260

@@ -265,9 +275,13 @@ static int cadence_codec_init(struct processing_module *mod)
265275
setup_cfg->avail = true;
266276
codec->cfg.avail = false;
267277

268-
/* direction follows the codec params in init data */
278+
/* direction follows the codec params; copy it out rather than
279+
* dereferencing a possibly unaligned uint32_t pointer
280+
*/
269281
init_bytes = (uint8_t *)ext_data->module_data;
270-
cd->direction = *(uint32_t *)(init_bytes + sizeof(struct snd_codec));
282+
memcpy(&direction, init_bytes + sizeof(struct snd_codec),
283+
sizeof(direction));
284+
cd->direction = direction;
271285

272286
comp_info(dev, "codec direction set to %u", cd->direction);
273287
}

0 commit comments

Comments
 (0)