]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ASoC: SOF: topology: reject invalid vendor array size in token parser
authorCássio Gabriel <cassiogabrielcontato@gmail.com>
Fri, 20 Mar 2026 00:45:26 +0000 (21:45 -0300)
committerMark Brown <broonie@kernel.org>
Fri, 20 Mar 2026 12:52:41 +0000 (12:52 +0000)
commit215e5fe75881a7e2425df04aeeed47a903d5cd5d
tree6c36edefffe9a94f639f9b70432371a187fb2ee0
parenta437601a0a1383260222223440a95dd4322eb7fa
ASoC: SOF: topology: reject invalid vendor array size in token parser

sof_parse_token_sets() accepts array->size values that can be invalid
for a vendor tuple array header. In particular, a zero size does not
advance the parser state and can lead to non-progress parsing on
malformed topology data.

Validate array->size against the minimum header size and reject values
smaller than sizeof(*array) before parsing. This preserves behavior for
valid topologies and hardens malformed-input handling.

Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20260319-sof-topology-array-size-fix-v1-1-f9191b16b1b7@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/sof/topology.c