From 974e05eb63a0193a574cd7c3e291f579fff6eef3 Mon Sep 17 00:00:00 2001 From: Shrushti P K Date: Tue, 20 Oct 2026 17:44:55 +0530 Subject: [PATCH] audio: cadence: ipc3: bound codec params copy to its stack buffer cadence_codec_resolve_api() copies the stream params extended data into a struct snd_codec on the stack, but passes ext_data_length as the memcpy_s() destination size, so the bound check can never fail. ext_data_length comes from SOF_IPC_STREAM_PCM_PARAMS and is only limited to SOF_IPC_MSG_MAX_SIZE - sizeof(struct sof_ipc_pcm_params), 276 bytes on IPC3 builds, while struct snd_codec is 120 bytes. A host sending larger extended data overflows the stack by up to 156 bytes when the codec is prepared. Use sizeof(codec_params) as the destination size so oversized extended data is rejected with -EINVAL. Signed-off-by: Shrushti P K --- src/audio/module_adapter/module/cadence_ipc3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/audio/module_adapter/module/cadence_ipc3.c b/src/audio/module_adapter/module/cadence_ipc3.c index 1afb08fc942a..c979f813f484 100644 --- a/src/audio/module_adapter/module/cadence_ipc3.c +++ b/src/audio/module_adapter/module/cadence_ipc3.c @@ -28,7 +28,7 @@ int cadence_codec_resolve_api(struct processing_module *mod) uint32_t codec_id = DEFAULT_CODEC_ID; if (mod->stream_params->ext_data_length) { - ret = memcpy_s(&codec_params, mod->stream_params->ext_data_length, + ret = memcpy_s(&codec_params, sizeof(codec_params), (uint8_t *)mod->stream_params + sizeof(*mod->stream_params), mod->stream_params->ext_data_length); if (ret < 0)