From 758eba9460c7ef088170d466a8bc96372be5fd42 Mon Sep 17 00:00:00 2001 From: Liam Girdwood Date: Thu, 11 Jun 2026 14:31:24 +0100 Subject: [PATCH] tools/probe: clamp out-of-range sample-rate index to a valid default The 4-bit sample-rate field can select an index past the end of the sample_rate[] table, which has fewer than 16 entries, reading out of bounds. Clamp an out-of-range index to a valid default rate (48000 Hz) so the read stays in bounds and the generated WAV header keeps a usable sample rate. Signed-off-by: Liam Girdwood --- tools/probes/probes_demux.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/tools/probes/probes_demux.c b/tools/probes/probes_demux.c index a411eef117b9..8cb7a3eb6b9d 100644 --- a/tools/probes/probes_demux.c +++ b/tools/probes/probes_demux.c @@ -125,7 +125,17 @@ int init_wave(struct dma_frame_parser *p, uint32_t buffer_id, uint32_t format) p->files[i].header.fmt.subchunk_size = 16; p->files[i].header.fmt.audio_format = 1; p->files[i].header.fmt.num_channels = ((format & PROBE_MASK_NB_CHANNELS) >> PROBE_SHIFT_NB_CHANNELS) + 1; - p->files[i].header.fmt.sample_rate = sample_rate[(format & PROBE_MASK_SAMPLE_RATE) >> PROBE_SHIFT_SAMPLE_RATE]; + /* the sample-rate field is 4 bits (0-15) but the table has fewer + * entries; fall back to a valid default (48000 Hz) for an out-of-range + * index so the read stays in bounds and the WAV header keeps a usable + * rate + */ + uint32_t rate_idx = (format & PROBE_MASK_SAMPLE_RATE) >> PROBE_SHIFT_SAMPLE_RATE; + + if (rate_idx >= sizeof(sample_rate) / sizeof(sample_rate[0])) + p->files[i].header.fmt.sample_rate = 48000; + else + p->files[i].header.fmt.sample_rate = sample_rate[rate_idx]; p->files[i].header.fmt.bits_per_sample = (((format & PROBE_MASK_CONTAINER_SIZE) >> PROBE_SHIFT_CONTAINER_SIZE) + 1) * 8; p->files[i].header.fmt.byte_rate = p->files[i].header.fmt.sample_rate * p->files[i].header.fmt.num_channels *