From: Harsh Raj Singhania <raj.harshraut@gmail.com>
Date: Wed, 30 Sep 2026 18:58:15 +0000 (+0530)
Subject: topology: fix uint32_t overflow in control decoder size checks
X-Git-Url: https://git.alsa-project.org/?a=commitdiff_plain;h=f8253a68baf9a5f57cdff1cd178920d13e5beb2b;p=alsa-lib.git

topology: fix uint32_t overflow in control decoder size checks

size2 = x->size + x->priv.size was computed in 32-bit arithmetic and could
wrap on a 64-bit host, bypassing the subsequent bounds check. Pre-check
for overflow then cast to size_t. Affects tplg_decode_control_mixer,
tplg_decode_control_enum, and tplg_decode_control_bytes.

Closes: https://github.com/alsa-project/alsa-lib/pull/527
Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/src/topology/ctl.c b/src/topology/ctl.c
index 322c461c..93a09f1e 100644
--- a/src/topology/ctl.c
+++ b/src/topology/ctl.c
@@ -1315,7 +1315,12 @@ next:
 	}
 	INIT_LIST_HEAD(&heap);
 	mc = bin;
-	size2 = mc->size + mc->priv.size;
+	if (mc->priv.size > size || mc->size > size - mc->priv.size) {
+		snd_error(TOPOLOGY, "mixer: element sizes overflow (%d, priv %d)",
+				    mc->size, mc->priv.size);
+		return -EINVAL;
+	}
+	size2 = (size_t)mc->size + (size_t)mc->priv.size;
 	if (size2 > size) {
 		snd_error(TOPOLOGY, "mixer: wrong element size (%d, priv %d)",
 				    mc->size, mc->priv.size);
@@ -1419,7 +1424,12 @@ next:
 	}
 	INIT_LIST_HEAD(&heap);
 	ec = bin;
-	size2 = ec->size + ec->priv.size;
+	if (ec->priv.size > size || ec->size > size - ec->priv.size) {
+		snd_error(TOPOLOGY, "enum: element sizes overflow (%d, priv %d)",
+				    ec->size, ec->priv.size);
+		return -EINVAL;
+	}
+	size2 = (size_t)ec->size + (size_t)ec->priv.size;
 	if (size2 > size) {
 		snd_error(TOPOLOGY, "enum: wrong element size (%d, priv %d)",
 				    ec->size, ec->priv.size);
@@ -1510,7 +1520,12 @@ next:
 		return -EINVAL;
 	}
 	bc = bin;
-	size2 = bc->size + bc->priv.size;
+	if (bc->priv.size > size || bc->size > size - bc->priv.size) {
+		snd_error(TOPOLOGY, "bytes: element sizes overflow (%d, priv %d)",
+				    bc->size, bc->priv.size);
+		return -EINVAL;
+	}
+	size2 = (size_t)bc->size + (size_t)bc->priv.size;
 	if (size2 > size) {
 		snd_error(TOPOLOGY, "bytes: wrong element size (%d, priv %d)",
 				    bc->size, bc->priv.size);