audio: selector: check source and sink buffers before prepare

The IPC4 fuzzer hit a NULL pointer dereference in selector_prepare().
ASan reports a READ SEGV at address 0x10 in
audio_buffer_hw_params_configured() reached from set_selector_params(),
UBSan reports "member access within null pointer of type 'struct
comp_buffer'" at selector.c set_selector_params().

The host can instantiate a selector (MICSEL) in a pipeline and send
SET_PIPELINE_STATE before binding any buffers to it. Prepare then runs
with empty source and sink lists, and set_selector_params() takes
comp_dev_get_first_data_producer() == NULL and dereferences
src_buf->audio_buffer.audio_stream_params (offset 0x10). The rest of
selector_verify_params() and selector_prepare() also use the first
producer/consumer without checking them.

look the sink/source count  at the start of selector_prepare() and fail
with -ENOTCONN if either is missing, as rtnr does. Valid topologies
always bind the selector before prepare, so this does not reject
legitimate configurations.

Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>

Author: tmleman

src/audio/selector/selector.c

@@ -1089,6 +1089,11 @@ static int selector_prepare(struct processing_module *mod,
 
 	comp_dbg(dev, "entry");
 
+	if (!num_of_sources || !num_of_sinks) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
 	ret = selector_params(mod);
 	if (ret < 0)
 		return ret;