From f034e98cac1152d1b6294a62347da27bb66a723e Mon Sep 17 00:00:00 2001 From: Shrushti P K Date: Wed, 14 Oct 2026 13:37:14 +0530 Subject: [PATCH] testbench: ipc4: bound mixer max against volume table size tb_kcontrol_cb_new() fills ctl->volume_table[i] for i in [0, tplg_mixer->max] while loading a VOLSW mixer control from a topology file. volume_table is a fixed unsigned int[TB_MAX_VOLUME_SIZE] (120) in struct tb_ctl, but max is the __u32 field copied verbatim from the topology blob with no upper bound, so a control declaring max >= 120 writes past volume_table and the rest of the struct, and a large max runs far past the glb->ctl allocation. max + 1 also wraps to 0 when max is UINT32_MAX. Reject max >= TB_MAX_VOLUME_SIZE before the fill loop. This also keeps the later volume_table[control_values[i]] reads in bounds, as they are limited to the same max. Signed-off-by: Shrushti P K --- tools/testbench/topology_ipc4.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tools/testbench/topology_ipc4.c b/tools/testbench/topology_ipc4.c index 9c4900f92fed..02dd66346bbd 100644 --- a/tools/testbench/topology_ipc4.c +++ b/tools/testbench/topology_ipc4.c @@ -1321,6 +1321,11 @@ static int tb_kcontrol_cb_new(struct snd_soc_tplg_ctl_hdr *tplg_ctl, strncpy(ctl->name, tplg_ctl->name, TB_MAX_CTL_NAME_CHARS); /* populate the volume table */ + if (tplg_mixer->max >= TB_MAX_VOLUME_SIZE) { + fprintf(stderr, "Error: mixer max %u exceeds volume table size %d\n", + tplg_mixer->max, TB_MAX_VOLUME_SIZE); + return -EINVAL; + } for (i = 0; i < tplg_mixer->max + 1 ; i++) { uint32_t val = vol_compute_gain(i, scale);