Skip to content

base_fw: reject undersized system time payload #10929

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kv2019i merged 1 commit into from
Jun 17, 2026
+3 −0
Merged

base_fw: reject undersized system time payload #10929

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/audio/base_fw.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,9 @@ __cold static uint32_t basefw_set_system_time(uint32_t param_id, bool first_bloc
if (!(first_block && last_block))
return IPC4_INVALID_REQUEST;

if (data_offset < sizeof(struct ipc4_system_time))
return IPC4_ERROR_INVALID_PARAM;
Comment on lines +280 to +281

@lgirdwood lgirdwood Jun 17, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

data_offset here is the payload size, not an offset — lyakh confirmed the same in the review. The large-config set path passes the fragment/payload length in this argument (the parameter name is misleading and worth renaming separately), so checking it against sizeof(struct ipc4_system_time) is correct.


global_system_time_info.host_time.val_l = ((const struct ipc4_system_time *)data)->val_l;
global_system_time_info.host_time.val_u = ((const struct ipc4_system_time *)data)->val_u;

Expand Down
Loading