Skip to content

Commit 0210345

Browse files
committed
Tools: Testbench: Fix bytes control data validation in tb_send_bytes_data
The change in removing bytes control blob in module init() triggered an issue in sof-testbench4. It resulted in valgrind fail with scripts/host-testbench.sh run with error "Invalid read of size 1" in "memcpy(msg + sizeof(config), (char *)abi->data + offset, chunk_size)". The invalid read happens when abi->data doesn't have chunk_size bytes available. The fix is to skip bytes controls with no private data to avoid reading garbage abi->size from adjacent topology buffer data, which causes invalid memory reads in tb_send_bytes_data(). Signed-off-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
1 parent 187b157 commit 0210345

2 files changed

Lines changed: 5 additions & 2 deletions

File tree

tools/testbench/topology_ipc4.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1358,7 +1358,9 @@ static int tb_kcontrol_cb_new(struct snd_soc_tplg_ctl_hdr *tplg_ctl,
13581358
tplg_bytes->priv.size);
13591359
return -EINVAL;
13601360
}
1361-
ctl->data = tplg_bytes->priv.data;
1361+
if (tplg_bytes->priv.size >= sizeof(struct sof_abi_hdr))
1362+
ctl->data = tplg_bytes->priv.data;
1363+
13621364
ctl->comp_info = comp_info;
13631365
strncpy(ctl->name, tplg_ctl->name, TB_MAX_CTL_NAME_CHARS);
13641366
break;

tools/testbench/utils_ipc4.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -290,7 +290,8 @@ static int tb_set_up_widget(struct testbench_prm *tp, struct tplg_comp_info *com
290290
/* send the bytes data from kcontrols associated with current widget */
291291
if (ctl->module_id != comp_info->module_id ||
292292
ctl->instance_id != comp_info->instance_id ||
293-
ctl->type != SND_SOC_TPLG_TYPE_BYTES)
293+
ctl->type != SND_SOC_TPLG_TYPE_BYTES ||
294+
!ctl->data)
294295
continue;
295296

296297
abi = (struct sof_abi_hdr *)ctl->data;

0 commit comments

Comments
 (0)