Skip to content

Commit 0ab4441

Browse files
cujomalaineykv2019i
authored andcommitted
ipc3: check alignment of ext data
Sizes are not currently checked for alignment, this can generated unaligned pointers for aligned types which is undefined behaviour. Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
1 parent 97e5c0d commit 0ab4441

1 file changed

Lines changed: 8 additions & 3 deletions

File tree

src/ipc/ipc3/helper.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ static const struct comp_driver *get_drv(struct sof_ipc_comp *comp)
8080
const struct comp_driver *drv = NULL;
8181
struct comp_driver_info *info;
8282
struct sof_ipc_comp_ext *comp_ext;
83+
uintptr_t offset;
8384
k_spinlock_key_t key;
8485

8586
/* do we have extended data ? */
@@ -112,9 +113,13 @@ static const struct comp_driver *get_drv(struct sof_ipc_comp *comp)
112113
goto out;
113114
}
114115

115-
comp_ext = (struct sof_ipc_comp_ext *)
116-
((uint8_t *)comp + comp->hdr.size -
117-
comp->ext_data_length);
116+
offset = comp->hdr.size - comp->ext_data_length;
117+
if ((offset & 0x3) != 0) {
118+
tr_err(&comp_tr, "Invalid ext data offset %lx", offset);
119+
goto out;
120+
}
121+
122+
comp_ext = (struct sof_ipc_comp_ext *)((uint8_t *)comp + offset);
118123

119124
/* UUID is first item in extended data - check its big enough */
120125
if (comp->ext_data_length < UUID_SIZE) {

0 commit comments

Comments
 (0)