From 326a04f5884830590c8230e3fb621db74592028c Mon Sep 17 00:00:00 2001 From: Tomasz Leman Date: Tue, 15 Sep 2026 14:51:59 +0200 Subject: [PATCH] audio: smart_amp_test: bound config size to struct size in get_config smart_amp_get_config() copies sad->config.size (bs) bytes from &sad->config into the host reply buffer, but only validated bs against the destination bound (size, the IPC max_data_size), never against the actual size of the source: sizeof(struct sof_smart_amp_config). sad->config.size is host-influenced: smart_amp_new() copies a create-time blob (including the embedded size field) into sad->config without validating that field, so a crafted blob can store an arbitrary size. A crafted blob (config.size = 247) followed by a binary GET_DATA request makes the DSP read 223 bytes past the 24-byte config, reported by AddressSanitizer as a use-after-poison read. Fix by validating bs against sizeof(struct sof_smart_amp_config) too, at the point of use, rejecting any oversized .size before it is used as a read length. This is the same pattern used for the channel-count bound added in commit 1007de2cf0 ("smart_amp_test: bound channel counts to platform max"). Signed-off-by: Tomasz Leman --- src/samples/audio/smart_amp_test_ipc3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/samples/audio/smart_amp_test_ipc3.c b/src/samples/audio/smart_amp_test_ipc3.c index da1f293eb55a..fe6076b26858 100644 --- a/src/samples/audio/smart_amp_test_ipc3.c +++ b/src/samples/audio/smart_amp_test_ipc3.c @@ -138,7 +138,7 @@ static int smart_amp_get_config(struct comp_dev *dev, comp_dbg(dev, "smart_amp_set_config(), actual blob size = %zu, expected blob size = %zu", bs, sizeof(struct sof_smart_amp_config)); - if (bs == 0 || bs > size) + if (bs == 0 || bs > size || bs > sizeof(struct sof_smart_amp_config)) return -EINVAL; ret = memcpy_s(cdata->data->data, size, &sad->config, bs);