From 4115737f1c20828c669b6813f6cbf6a3604866e1 Mon Sep 17 00:00:00 2001 From: Shrushti P K Date: Thu, 22 Oct 2026 22:26:41 +0530 Subject: [PATCH] audio: dax: check param header fits before reading it update_params_from_buffer() walks the DAX tuning blob as a sequence of struct module_param records but reads param->id and param->size before checking that a whole 8-byte header is left in the buffer. The blob comes from the host via IPC4_DAX_MODULE_CFG_PARAM_BLOB (or the IPC3 binary control) and comp_data_blob_set() stores it in a heap buffer of exactly the received size. A blob that leaves 1 to 7 bytes after its last complete record, or is shorter than one header, makes the loop read up to 7 bytes past the end of that allocation. The nested DAX_PARAM_ID_ENDPOINT walk goes through the same loop. Reject a truncated header at the top of the loop, as the module_param walkers in waves.c, dts.c and cadence.c already do. --- src/audio/module_adapter/module/dolby/dax.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/audio/module_adapter/module/dolby/dax.c b/src/audio/module_adapter/module/dolby/dax.c index 0d53f47a758d..a9d9182a3e57 100644 --- a/src/audio/module_adapter/module/dolby/dax.c +++ b/src/audio/module_adapter/module/dolby/dax.c @@ -469,6 +469,12 @@ static int update_params_from_buffer(struct processing_module *mod, void *data, uint32_t param_data_size; for (uint32_t i = 0; i < data_size;) { + /* Need a whole param header in the remaining bytes to read id/size */ + if (data_size - i < param_header_size) { + comp_err(dev, "param header truncated, pos %u, size %u", i, data_size); + return -EINVAL; + } + param = (struct module_param *)(pos); if (param->size < param_header_size || param->size > data_size - i ||