Skip to content

Commit

Permalink
waves: verify payload size in waves.c
Browse files Browse the repository at this point in the history
    Enhance payload corruption handling by verifying size

Signed-off-by: barry.jan <barry.jan@waves.com>
  • Loading branch information
barry-waves committed Apr 8, 2024
1 parent 07b762e commit fde8fd9
Showing 1 changed file with 42 additions and 4 deletions.
46 changes: 42 additions & 4 deletions src/audio/module_adapter/module/waves/waves.c
Original file line number Diff line number Diff line change
Expand Up @@ -565,6 +565,44 @@ static int waves_effect_handle_param_message(struct processing_module *mod,
return ret;
}

static int waves_effect_verify_payload_size(struct processing_module *mod)
{
int ret = 0;
struct comp_dev *dev = mod->dev;
struct module_data *codec = &mod->priv;
struct module_param *param;
struct module_config *cfg = &codec->cfg;

if (cfg->size > MAX_CONFIG_SIZE_BYTES) {
comp_err(dev, "waves_effect_verify_payload_size() provided config is too big, size %d",
cfg->size);
return -EINVAL;
}

/* sizes of individual module_param's must add up to 'cfg->size' */
int index = 0;
const uint32_t header_size = sizeof(param->size) + sizeof(param->id);

while (index < cfg->size && (!ret)) {
param = (struct module_param *)((char *)cfg->data + index);
if ((param->size <= header_size) || (param->size > MAX_CONFIG_SIZE_BYTES)) {
comp_err(dev, "waves_effect_verify_payload_size() invalid module_param size: %d",
param->size);
ret = -EINVAL;
break;
}
if ((index + param->size) > cfg->size) {
comp_err(dev, "waves_effect_verify_payload_size() module_param size: %d exceeds cfg buffer size: %d",
param->size, cfg->size);
ret = -EINVAL;
break;
}
index += param->size;
}

return ret;
}

/* apply codec config */
static int waves_effect_apply_config(struct processing_module *mod)
{
Expand Down Expand Up @@ -592,10 +630,10 @@ static int waves_effect_apply_config(struct processing_module *mod)
}
}

if (cfg->size > MAX_CONFIG_SIZE_BYTES) {
comp_err(dev, "waves_effect_apply_config() provided config is too big, size %d",
cfg->size);
return -EINVAL;
ret = waves_effect_verify_payload_size(mod);
if (ret) {
comp_err(dev, "waves_effect_apply_config() verify payload failed %d", ret);
return ret;
}

/* incoming data in cfg->data is arranged according to struct module_param
Expand Down

0 comments on commit fde8fd9

Please sign in to comment.