From 218f57c7ad2e2dffa9f1ee3e15df438e5e86da47 Mon Sep 17 00:00:00 2001 From: Syed Mohammed Nayyar Date: Sat, 4 Jul 2026 00:28:08 +0530 Subject: [PATCH] tools: ctl: bound csv data write against abi header size The ascii csv branch of read_setup() advances the write index past the 32-byte abi header for -r (no_abi) input but still bounds each write with n < n_max, while the binary branch stops at n_max - abi_size. A csv tuning file with ctrl_size/4 values then writes sizeof(struct sof_abi_hdr) bytes past the end of the tlv buffer. ctrl_size is not guaranteed to be a multiple of sizeof(uint32_t) either, so bounding the byte count alone still lets the final 4-byte store run up to 3 bytes past the buffer. Count the csv values and stop after the last whole uint32_t that fits in the data area, which also keeps the loop from mixing a size in bytes with an index into a uint32_t array. Signed-off-by: Syed Mohammed Nayyar --- tools/ctl/ctl.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/tools/ctl/ctl.c b/tools/ctl/ctl.c index c669349b68f9..f21c9b0b3ed3 100644 --- a/tools/ctl/ctl.c +++ b/tools/ctl/ctl.c @@ -121,7 +121,8 @@ static int read_setup(struct ctl_data *ctl_data) int n = 0; FILE *fh; int data_start_int_index = 0; - int data_int_index; + int val_index = 0; + int val_max; /* open input file */ fh = fdopen(ctl_data->in_fd, mode); @@ -144,22 +145,25 @@ static int read_setup(struct ctl_data *ctl_data) } /* reading for ASCII CSV txt */ - data_int_index = data_start_int_index; + /* whole uint32_t values the data area can hold, the trailing bytes of an + * unaligned control size are unusable + */ + val_max = (n_max - abi_size) / (int)sizeof(uint32_t); while (fscanf(fh, "%u", &x) != EOF) { - if (n < n_max) - ctl_data->buffer[data_int_index] = x; + if (val_index < val_max) + ctl_data->buffer[data_start_int_index + val_index] = x; - if (n > 0) + if (val_index > 0) fprintf(stdout, ","); fprintf(stdout, "%u", x); separator = fgetc(fh); while (separator != ',' && separator != EOF) separator = fgetc(fh); - data_int_index++; - n += sizeof(uint32_t); + val_index++; } + n = val_index * (int)sizeof(uint32_t); fprintf(stdout, "\n"); read_done: