From 9ba6f9251027c73f6bad846d63eab9bb5f89fdf2 Mon Sep 17 00:00:00 2001 From: Liam Girdwood Date: Thu, 11 Jun 2026 14:30:13 +0100 Subject: [PATCH] base_fw: reject undersized system time payload The system-time handler dereferenced the payload as a fixed struct without checking the supplied size, reading past the mailbox for a short payload. Reject a payload smaller than the struct. Signed-off-by: Liam Girdwood --- src/audio/base_fw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/audio/base_fw.c b/src/audio/base_fw.c index b86db469765a..b94ea7628fe5 100644 --- a/src/audio/base_fw.c +++ b/src/audio/base_fw.c @@ -277,6 +277,9 @@ __cold static uint32_t basefw_set_system_time(uint32_t param_id, bool first_bloc if (!(first_block && last_block)) return IPC4_INVALID_REQUEST; + if (data_offset < sizeof(struct ipc4_system_time)) + return IPC4_ERROR_INVALID_PARAM; + global_system_time_info.host_time.val_l = ((const struct ipc4_system_time *)data)->val_l; global_system_time_info.host_time.val_u = ((const struct ipc4_system_time *)data)->val_u;