Skip to content

Tplg parser security fixes #10896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jsarha wants to merge 3 commits into
base: main
Choose a base branch
from
+53 −9
Open

Tplg parser security fixes #10896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b665e4c
tools: tplg_parser: add bounds checking to topology object reader macros
Jun 12, 2026
5fcc774
tools: tplg_parser: fix stack buffer overflow in tplg_create_graph()
Jun 12, 2026
0e95cfa
tools: probes: reject oversized data_size_bytes to prevent integer ov…
Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions tools/probes/probes_demux.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
#define APP_NAME "sof-probes"

#define PACKET_MAX_SIZE 4096 /**< Size limit for probe data packet */
#define PACKET_DATA_SIZE_MAX (16 * 1024 * 1024) /**< Sanity limit for packet data size */
#define DATA_READ_LIMIT 4096 /**< Data limit for file read */
#define FILES_LIMIT 32 /**< Maximum num of probe output files */
#define FILE_PATH_LIMIT 128 /**< Path limit for probe output files */
Expand Down Expand Up @@ -194,6 +195,12 @@ int process_sync(struct dma_frame_parser *p)
{
struct probe_data_packet *temp_packet;

if (p->packet->data_size_bytes > PACKET_DATA_SIZE_MAX) {
fprintf(stderr, "error: packet data size %u exceeds maximum %u\n",
p->packet->data_size_bytes, PACKET_DATA_SIZE_MAX);
return -EINVAL;
}
Comment on lines +198 to +202

/* request to copy data_size from probe packet and 64-bit checksum */
p->total_data_to_copy = p->packet->data_size_bytes + sizeof(uint64_t);

Expand Down
3 changes: 2 additions & 1 deletion tools/testbench/topology_ipc3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,8 @@ static int tb_register_graph(struct tplg_context *ctx, struct tplg_comp_info *te

for (i = 0; i < num_connections; i++) {
ret = tplg_create_graph(ctx, num_comps, pipeline_id, temp_comp_list,
pipeline_string, &connection, i);
pipeline_string, sizeof(pipeline_string),
&connection, i);
if (ret < 0)
return ret;

Expand Down
23 changes: 17 additions & 6 deletions tools/tplg_parser/graph.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
/* load pipeline graph DAPM widget*/
int tplg_create_graph(struct tplg_context *ctx, int count, int pipeline_id,
struct tplg_comp_info *temp_comp_list, char *pipeline_string,
size_t pipeline_string_size,
struct sof_ipc_pipe_comp_connect *connection,
int route_num)
{
Expand Down Expand Up @@ -64,12 +65,22 @@ int tplg_create_graph(struct tplg_context *ctx, int count, int pipeline_id,

printf("loading route %s -> %s\n", source, sink);

strcat(pipeline_string, graph_elem->source);
strcat(pipeline_string, "->");

if (route_num == (count - 1)) {
strcat(pipeline_string, graph_elem->sink);
strcat(pipeline_string, "\n");
{
size_t cur_len = strlen(pipeline_string);
size_t remaining = pipeline_string_size > cur_len ?
pipeline_string_size - cur_len : 0;
int written;

if (route_num == (count - 1))
written = snprintf(pipeline_string + cur_len, remaining,
"%s->%s\n", graph_elem->source,
graph_elem->sink);
else
written = snprintf(pipeline_string + cur_len, remaining,
"%s->", graph_elem->source);

if (written < 0 || (size_t)written >= remaining)
fprintf(stderr, "warning: pipeline string truncated\n");
Comment on lines +69 to +83
}

return 0;
Expand Down
29 changes: 27 additions & 2 deletions tools/tplg_parser/include/tplg_parser/topology.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@
#include <stdbool.h>
#include <stdarg.h>
#include <stddef.h>
#include <assert.h>
#include <stdio.h>
#include <ipc/dai.h>
#include <ipc/topology.h>
#include <ipc/stream.h>
Expand Down Expand Up @@ -194,8 +196,20 @@ struct tplg_context {

#define tplg_get(ctx) ((void *)(ctx->tplg_base + ctx->tplg_offset))

#define tplg_check_bounds(ctx, advance) \
do { \
if ((long)(advance) < 0 || \
ctx->tplg_offset + (long)(advance) > (long)ctx->tplg_size) { \
printf("%s %d topology offset %ld + %ld > size %zu\n", \
__func__, __LINE__, ctx->tplg_offset, \
(long)(advance), ctx->tplg_size); \

@lyakh lyakh Jun 12, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ctx should be in parentheses

assert(0); \
} \
} while (0)
Comment on lines +199 to +208

#define tplg_get_hdr(ctx) \
({struct snd_soc_tplg_hdr *ptr; \
tplg_check_bounds(ctx, sizeof(*ptr)); \
ptr = (struct snd_soc_tplg_hdr *)(ctx->tplg_base + ctx->tplg_offset); \
if (ptr->size != sizeof(*ptr)) { \
printf("%s %d hdr size mismatch 0x%x:0x%zx at offset %ld\n", \
Expand All @@ -206,30 +220,40 @@ struct tplg_context {

#define tplg_skip_hdr_payload(ctx) \
({struct snd_soc_tplg_hdr *ptr; \
tplg_check_bounds(ctx, hdr->payload_size); \
ptr = (struct snd_soc_tplg_hdr *)(ctx->tplg_base + ctx->tplg_offset); \
ctx->tplg_offset += hdr->payload_size; (void *)ptr; })
Comment on lines 221 to 225

#define tplg_get_object(ctx, obj) \
({void *ptr; ptr = ctx->tplg_base + ctx->tplg_offset; \
({void *ptr; \
tplg_check_bounds(ctx, sizeof(*(obj))); \
ptr = ctx->tplg_base + ctx->tplg_offset; \
ctx->tplg_offset += sizeof(*(obj)); ptr; })

#define tplg_get_object_priv(ctx, obj, priv_size) \
({void *ptr; ptr = ctx->tplg_base + ctx->tplg_offset; \
({void *ptr; \
tplg_check_bounds(ctx, sizeof(*(obj)) + (priv_size)); \
ptr = ctx->tplg_base + ctx->tplg_offset; \

@lyakh lyakh Jun 12, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same in these macros and below too

ctx->tplg_offset += sizeof(*(obj)) + priv_size; ptr; })

#define tplg_get_widget(ctx) \
({struct snd_soc_tplg_dapm_widget *w; \
tplg_check_bounds(ctx, sizeof(*w)); \
w = (struct snd_soc_tplg_dapm_widget *)(ctx->tplg_base + ctx->tplg_offset); \
tplg_check_bounds(ctx, sizeof(*w) + w->priv.size); \
ctx->tplg_offset += sizeof(*w) + w->priv.size; w; })

#define tplg_get_graph(ctx) \
({struct snd_soc_tplg_dapm_graph_elem *w; \
tplg_check_bounds(ctx, sizeof(*w)); \
w = (struct snd_soc_tplg_dapm_graph_elem *)(ctx->tplg_base + ctx->tplg_offset); \
ctx->tplg_offset += sizeof(*w); w; })

#define tplg_get_pcm(ctx) \
({struct snd_soc_tplg_pcm *pcm; \
tplg_check_bounds(ctx, sizeof(*pcm)); \
pcm = (struct snd_soc_tplg_pcm *)(ctx->tplg_base + ctx->tplg_offset); \
tplg_check_bounds(ctx, sizeof(*pcm) + pcm->priv.size); \
ctx->tplg_offset += sizeof(*pcm) + pcm->priv.size; pcm; })

static inline int tplg_valid_widget(struct snd_soc_tplg_dapm_widget *widget)
Expand Down Expand Up @@ -314,6 +338,7 @@ int tplg_new_process(struct tplg_context *ctx, void *process, size_t process_siz

int tplg_create_graph(struct tplg_context *ctx, int count, int pipeline_id,
struct tplg_comp_info *temp_comp_list, char *pipeline_string,
size_t pipeline_string_size,
struct sof_ipc_pipe_comp_connect *connection,
int route_num);

Expand Down
Loading