From: Harsh Raj Singhania <raj.harshraut@gmail.com>
Date: Wed, 30 Sep 2026 18:58:37 +0000 (+0530)
Subject: pcm: cap route plugin ttable channel dimensions at 1024
X-Git-Url: https://git.alsa-project.org/?a=commitdiff_plain;h=807e4ded9511e7e3cd17b915ea3cda1faf6611e6;p=alsa-lib.git

pcm: cap route plugin ttable channel dimensions at 1024

csize/ssize grew from config-supplied channel indices with no upper
bound before malloc(csize * ssize * sizeof(entry)). Cap both at 1024,
consistent with other PCM plugins.

[ fixed coding style -- tiwai ]

Closes: https://github.com/alsa-project/alsa-lib/pull/527
Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/src/pcm/pcm_route.c b/src/pcm/pcm_route.c
index 3836dcc3..4f1e004e 100644
--- a/src/pcm/pcm_route.c
+++ b/src/pcm/pcm_route.c
@@ -1098,6 +1098,11 @@ static int _snd_pcm_route_determine_ttable(snd_config_t *tt,
 		}
 		if (cchannel + 1 > csize)
 			csize = cchannel + 1;
+		if (csize > 1024) {
+			SNDERR("route: client channel %d exceeds max (1024)",
+			       cchannel);
+			return -EINVAL;
+		}
 		if (snd_config_get_type(in) != SND_CONFIG_TYPE_COMPOUND)
 			return -EINVAL;
 		snd_config_for_each(j, jnext, in) {
@@ -1113,6 +1118,11 @@ static int _snd_pcm_route_determine_ttable(snd_config_t *tt,
 			}
 			if (schannel + 1 > ssize)
 				ssize = schannel + 1;
+			if (ssize > 1024) {
+				SNDERR("route: slave channel %d exceeds max (1024)",
+				       schannel);
+				return -EINVAL;
+			}
 		}
 	}
 	if (csize == 0 || ssize == 0) {