From 902eb7c896864bae0fe9972764b54505e9f74ad2 Mon Sep 17 00:00:00 2001 From: Liam Girdwood Date: Wed, 17 Jun 2026 14:34:13 +0100 Subject: [PATCH] rtnr: reject out-of-range control switch element counts The SWITCH control get and set handlers looped over a host-supplied element count while reading/writing the control channel array, which could run past the IPC payload. Reject counts larger than the maximum channel count in both handlers before the loop. Signed-off-by: Liam Girdwood --- src/audio/rtnr/rtnr.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/audio/rtnr/rtnr.c b/src/audio/rtnr/rtnr.c index 45ff62a60f8d..13c4f8d12b4d 100644 --- a/src/audio/rtnr/rtnr.c +++ b/src/audio/rtnr/rtnr.c @@ -454,6 +454,11 @@ static int rtnr_get_config(struct processing_module *mod, return rtnr_get_bin_data(mod, cdata, fragment_size); case SOF_CTRL_CMD_SWITCH: + if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) { + comp_err(dev, "num_elems %u > max %u", + cdata->num_elems, SOF_IPC_MAX_CHANNELS); + return -EINVAL; + } for (j = 0; j < cdata->num_elems; j++) { cdata->chanv[j].channel = j; cdata->chanv[j].value = cd->process_enable; @@ -560,6 +565,12 @@ static int32_t rtnr_set_value(struct processing_module *mod, void *ctl_data) uint32_t val = 0; int32_t j; + if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) { + comp_err(dev, "num_elems %u > max %u", + cdata->num_elems, SOF_IPC_MAX_CHANNELS); + return -EINVAL; + } + for (j = 0; j < cdata->num_elems; j++) { val |= cdata->chanv[j].value; comp_dbg(dev, "value = %u", val);