Skip to content

bound control name and value copies in tb_parse_amixer#10947

Open
jmestwa-coder wants to merge 1 commit into
thesofproject:mainfrom
jmestwa-coder:testbench-amixer-bound
Open

bound control name and value copies in tb_parse_amixer#10947
jmestwa-coder wants to merge 1 commit into
thesofproject:mainfrom
jmestwa-coder:testbench-amixer-bound

Conversation

@jmestwa-coder

Copy link
Copy Markdown
Contributor

tb_parse_amixer copies the parsed control name and value into fixed 128-byte stack buffers with no length check on the data read from the control script:

  • control_name: len comes from the cset name="..." quote delimiters, never capped to TB_MAX_CTL_NAME_CHARS
  • control_params: same unchecked copy for the value after the closing quote
  • a name longer than the buffer overflows the stack; the sibling tb_parse_sofctl avoids this by using strndup
    Reject over-length fields before each memcpy.

Signed-off-by: jmestwa-coder <jmestwa@gmail.com>
@jmestwa-coder jmestwa-coder requested a review from ranj063 as a code owner June 21, 2026 07:55
@sofci

sofci commented Jun 21, 2026

Copy link
Copy Markdown
Collaborator

Can one of the admins verify this patch?

reply test this please to run this test once

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens tb_parse_amixer() in the SOF testbench by rejecting over-length control names and values parsed from control scripts, preventing stack buffer overflows when copying into fixed-size buffers.

Changes:

  • Add bounds checks for the parsed control name length before copying into control_name.
  • Add bounds checks for the parsed control value length before copying into control_params.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants