From 535f13a99dcb231ddc4cf9713782ae0abe9c2ddc Mon Sep 17 00:00:00 2001 From: jmestwa-coder Date: Sun, 21 Jun 2026 13:24:58 +0530 Subject: [PATCH] bound control name and value copies in tb_parse_amixer Signed-off-by: jmestwa-coder --- tools/testbench/utils.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/testbench/utils.c b/tools/testbench/utils.c index 597e3aaa043d..91c08c62aab1 100644 --- a/tools/testbench/utils.c +++ b/tools/testbench/utils.c @@ -368,10 +368,18 @@ static int tb_parse_amixer(struct testbench_prm *tp, char *line) } len = end_str - name_str - find_len; + if (len < 0 || len >= TB_MAX_CTL_NAME_CHARS) { + fprintf(stderr, "error: control name too long in script line: %s\n", line); + return -EINVAL; + } memcpy(control_name, name_str + find_len, len); line_end = line + strlen(line); len = line_end - end_str - find_end_len; + if (len < 0 || len >= TB_MAX_CTL_NAME_CHARS) { + fprintf(stderr, "error: control value too long in script line: %s\n", line); + return -EINVAL; + } memcpy(control_params, &end_str[find_end_len], len); printf("Info: Setting control name '%s' to value (%s)\n", control_name, control_params);