waves: verify payload size in waves.c

    Enhance payload corruption handling by verifying size

Signed-off-by: barry.jan <barry.jan@waves.com>

src/audio/module_adapter/module/waves/waves.c

@@ -565,6 +565,44 @@ static int waves_effect_handle_param_message(struct processing_module *mod,
 	return ret;
 }
 
+static int waves_effect_verify_payload_size(struct processing_module *mod)
+{
+	int ret = 0;
+	struct comp_dev *dev = mod->dev;
+	struct module_data *codec = &mod->priv;
+	struct module_param *param;
+	struct module_config *cfg = &codec->cfg;
+
+	if (cfg->size > MAX_CONFIG_SIZE_BYTES) {
+		comp_err(dev, "waves_effect_verify_payload_size() provided config is too big, size %d",
+			cfg->size);
+		return -EINVAL;
+	}
+
+	/* sizes of individual module_param's must add up to 'cfg->size' */
+	int index = 0;
+	const uint32_t header_size = sizeof(param->size) + sizeof(param->id);
+
+	while (index < cfg->size && (!ret)) {
+		param = (struct module_param *)((char *)cfg->data + index);
+		if ((param->size <= header_size) || (param->size > MAX_CONFIG_SIZE_BYTES)) {
+			comp_err(dev, "waves_effect_verify_payload_size() invalid module_param size: %d",
+				param->size);
+			ret = -EINVAL;
+			break;
+		}
+		if ((index + param->size) > cfg->size) {
+			comp_err(dev, "waves_effect_verify_payload_size() module_param size: %d exceeds cfg buffer size: %d",
+				param->size, cfg->size);
+			ret = -EINVAL;
+			break;
+		}
+		index += param->size;
+	}
+
+	return ret;
+}
+
 /* apply codec config */
 static int waves_effect_apply_config(struct processing_module *mod)
 {
@@ -592,10 +630,10 @@ static int waves_effect_apply_config(struct processing_module *mod)
 		}
 	}
 
-	if (cfg->size > MAX_CONFIG_SIZE_BYTES) {
-		comp_err(dev, "waves_effect_apply_config() provided config is too big, size %d",
-			 cfg->size);
-		return -EINVAL;
+	ret = waves_effect_verify_payload_size(mod);
+	if (ret) {
+		comp_err(dev, "waves_effect_apply_config() verify payload failed %d", ret);
+		return ret;
 	}
 
 	/* incoming data in cfg->data is arranged according to struct module_param