Skip to content

audio: crossover: Improve robustness for invalid configuration #10904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
singalsu wants to merge 1 commit into
base: main
Choose a base branch
from
+30 −4
Open

audio: crossover: Improve robustness for invalid configuration #10904

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 30 additions & 4 deletions src/audio/crossover/crossover.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,15 +350,23 @@ static int crossover_free(struct processing_module *mod)
* \brief Verifies that the config is formatted correctly.
*
* The function can only be called after the buffers have been initialized.
*
* \param[in] mod Processing module owning the configuration.
* \param[in] config Configuration blob to validate.
* \param[in] new_size Size in bytes reported by the framework for \p config;
* must match the size field embedded in the blob header.
* \return 0 on success, negative errno on invalid configuration.
*/
static int crossover_validate_config(struct processing_module *mod,
struct sof_crossover_config *config)
struct sof_crossover_config *config, size_t new_size)
{
struct comp_dev *dev = mod->dev;
uint32_t size = config->size;
size_t required_size;
int32_t num_assigned_sinks;
int32_t num_lr4s;

if (size > SOF_CROSSOVER_MAX_SIZE || !size) {
if (size > SOF_CROSSOVER_MAX_SIZE || !size || size != new_size) {
comp_err(dev, "size %d is invalid", size);
return -EINVAL;
Comment on lines +369 to 371
}
Expand All @@ -370,6 +378,18 @@ static int crossover_validate_config(struct processing_module *mod,
return -EINVAL;
}

/* Each channel reads 2 * num_lr4s biquads from config->coef[]; the
* runtime uses 1 LR4 pair for 2-way and 3 LR4 pairs otherwise.
* See tune/sof_crossover_generate_config.m script.
*/
num_lr4s = (config->num_sinks == CROSSOVER_2WAY_NUM_SINKS) ? 1 : 3;
required_size = sizeof(*config) + (size_t)num_lr4s * 2 * sizeof(struct sof_eq_iir_biquad);
if (size < required_size) {
Comment on lines +381 to +387
comp_err(dev, "size %u too small for num_sinks %u, need at least %zu",
size, config->num_sinks, required_size);
return -EINVAL;
}

/* Align the crossover's sinks, to their respective configuration in
* the config.
*/
Expand Down Expand Up @@ -448,14 +468,20 @@ static int crossover_process_audio_stream(struct processing_module *mod,
uint32_t frames = input_buffers[0].size;
uint32_t frame_bytes = audio_stream_frame_bytes(input_buffers[0].data);
uint32_t processed_bytes;
size_t cfg_size;
int ret;
int i;

comp_dbg(dev, "entry");

/* Check for changed configuration */
if (comp_is_new_data_blob_available(cd->model_handler)) {
cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
cd->config = comp_get_data_blob(cd->model_handler, &cfg_size, NULL);
if (!cd->config || !cfg_size ||
crossover_validate_config(mod, cd->config, cfg_size) < 0) {
comp_err(dev, "invalid runtime config blob");
return -EINVAL;
}
Comment on lines 478 to +484
ret = crossover_setup(mod, audio_stream_get_channels(source));
if (ret < 0) {
comp_err(dev, "failed Crossover setup");
Expand Down Expand Up @@ -547,7 +573,7 @@ static int crossover_prepare(struct processing_module *mod,

/* Initialize Crossover */
if (cd->config &&
(!data_size || crossover_validate_config(mod, cd->config) < 0)) {
(!data_size || crossover_validate_config(mod, cd->config, data_size) < 0)) {
/* If the configuration is invalid fail the prepare */
comp_err(dev, "invalid binary config format");
return -EINVAL;
Expand Down
Loading