Repository navigation
audio: dax: check param header fits before reading it - #11342
Shrusti-pk wants to merge 1 commit into
Conversation
update_params_from_buffer() walks the DAX tuning blob as a sequence of struct module_param records but reads param->id and param->size before checking that a whole 8-byte header is left in the buffer. The blob comes from the host via IPC4_DAX_MODULE_CFG_PARAM_BLOB (or the IPC3 binary control) and comp_data_blob_set() stores it in a heap buffer of exactly the received size. A blob that leaves 1 to 7 bytes after its last complete record, or is shorter than one header, makes the loop read up to 7 bytes past the end of that allocation. The nested DAX_PARAM_ID_ENDPOINT walk goes through the same loop. Reject a truncated header at the top of the loop, as the module_param walkers in waves.c, dts.c and cadence.c already do.
|
Can one of the admins verify this patch?
|
PR 11342: test resultsRun date: 2026-10-26 10:52 UTC Tested commit: 4115737f1c20828c669b6813f6cbf6a3604866e1
|
There was a problem hiding this comment.
🟢 Approval recommended
The narrow bounds check safely rejects truncated headers before access without changing valid-record processing.
No open issues 🎉
What changed in this PR
This PR hardens the DAX tuning-blob parser against out-of-bounds reads from truncated parameter headers.
Changes:
- Checks that a complete header remains before accessing parameter fields.
- Returns
-EINVALfor truncated headers while preserving valid-record parsing.
| File | Description |
|---|---|
src/audio/module_adapter/module/dolby/dax.c |
Adds a remaining-length guard before reading each parameter header. |
Review effort: Balanced
|
Thx @Shrusti-pk. This is indeed a bug. This issue will be fixed together in the |
|
Fine by me, holding this one. I had a look at #11350 and the remain < header_size test in get_next_param covers the same truncated header case, including the nested endpoint walk since apply_blob_params goes through the same helper, so this can be closed once that lands. |
update_params_from_buffer() in the DAX module reads each module_param header before checking that 8 bytes are left in the tuning blob:
The waves.c, dts.c and cadence.c module_param walkers already reject a truncated header this way. Blobs made of whole records parse as before.