Repository navigation
audio: cadence: ipc3: bound codec params copy to its stack buffer - #11325
Open
Shrusti-pk wants to merge 1 commit into
Open
Shrusti-pk wants to merge 1 commit into
Shrusti-pk wants to merge 1 commit into
Conversation
cadence_codec_resolve_api() copies the stream params extended data into a struct snd_codec on the stack, but passes ext_data_length as the memcpy_s() destination size, so the bound check can never fail. ext_data_length comes from SOF_IPC_STREAM_PCM_PARAMS and is only limited to SOF_IPC_MSG_MAX_SIZE - sizeof(struct sof_ipc_pcm_params), 276 bytes on IPC3 builds, while struct snd_codec is 120 bytes. A host sending larger extended data overflows the stack by up to 156 bytes when the codec is prepared. Use sizeof(codec_params) as the destination size so oversized extended data is rejected with -EINVAL. Signed-off-by: Shrushti P K <shrusthi@labs.digiscrypt.com>
Shrusti-pk
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
October 20, 2026 12:42
Collaborator
|
Can one of the admins verify this patch?
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cadence_codec_resolve_api() on IPC3 hands the host-supplied ext_data_length to memcpy_s() as the destination size of a stack struct snd_codec, so the bound check never trips:
The IPC4 variant reads the codec params from the size-checked init payload and is not affected.