From f8253a68baf9a5f57cdff1cd178920d13e5beb2b Mon Sep 17 00:00:00 2001 From: Harsh Raj Singhania Date: Thu, 1 Oct 2026 00:28:15 +0530 Subject: [PATCH] topology: fix uint32_t overflow in control decoder size checks size2 = x->size + x->priv.size was computed in 32-bit arithmetic and could wrap on a 64-bit host, bypassing the subsequent bounds check. Pre-check for overflow then cast to size_t. Affects tplg_decode_control_mixer, tplg_decode_control_enum, and tplg_decode_control_bytes. Closes: https://github.com/alsa-project/alsa-lib/pull/527 Signed-off-by: Harsh Raj Singhania Signed-off-by: Takashi Iwai --- src/topology/ctl.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/src/topology/ctl.c b/src/topology/ctl.c index 322c461c..93a09f1e 100644 --- a/src/topology/ctl.c +++ b/src/topology/ctl.c @@ -1315,7 +1315,12 @@ next: } INIT_LIST_HEAD(&heap); mc = bin; - size2 = mc->size + mc->priv.size; + if (mc->priv.size > size || mc->size > size - mc->priv.size) { + snd_error(TOPOLOGY, "mixer: element sizes overflow (%d, priv %d)", + mc->size, mc->priv.size); + return -EINVAL; + } + size2 = (size_t)mc->size + (size_t)mc->priv.size; if (size2 > size) { snd_error(TOPOLOGY, "mixer: wrong element size (%d, priv %d)", mc->size, mc->priv.size); @@ -1419,7 +1424,12 @@ next: } INIT_LIST_HEAD(&heap); ec = bin; - size2 = ec->size + ec->priv.size; + if (ec->priv.size > size || ec->size > size - ec->priv.size) { + snd_error(TOPOLOGY, "enum: element sizes overflow (%d, priv %d)", + ec->size, ec->priv.size); + return -EINVAL; + } + size2 = (size_t)ec->size + (size_t)ec->priv.size; if (size2 > size) { snd_error(TOPOLOGY, "enum: wrong element size (%d, priv %d)", ec->size, ec->priv.size); @@ -1510,7 +1520,12 @@ next: return -EINVAL; } bc = bin; - size2 = bc->size + bc->priv.size; + if (bc->priv.size > size || bc->size > size - bc->priv.size) { + snd_error(TOPOLOGY, "bytes: element sizes overflow (%d, priv %d)", + bc->size, bc->priv.size); + return -EINVAL; + } + size2 = (size_t)bc->size + (size_t)bc->priv.size; if (size2 > size) { snd_error(TOPOLOGY, "bytes: wrong element size (%d, priv %d)", bc->size, bc->priv.size); -- 2.52.0