Tplg parser security fixes by jsarha · Pull Request #10896 · thesofproject/sof

jsarha · 2026-06-12T11:37:37Z

Security fixes for development toos.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds defensive bounds checking and safer string formatting to harden the topology parser and related tooling against malformed/untrusted inputs.

Changes:

Introduces a topology buffer bounds-check macro and applies it to multiple topology accessors.
Replaces unsafe strcat() concatenation with size-bounded snprintf() in graph pipeline-string construction.
Adds a sanity limit for probe packet data sizes to avoid oversized allocations/copies.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
tools/tplg_parser/include/tplg_parser/topology.h	Adds bounds checking helpers and applies them to topology object getters; extends `tplg_create_graph()` API with buffer size.
tools/tplg_parser/graph.c	Uses `snprintf()` with remaining capacity to avoid `strcat()` overflows when building the pipeline string.
tools/testbench/topology_ipc3.c	Updates caller to pass `pipeline_string` capacity to `tplg_create_graph()`.
tools/probes/probes_demux.c	Adds a maximum allowed probe packet data size and rejects oversized packets.

jsarha · 2026-06-15T15:47:24Z

 #define tplg_skip_hdr_payload(ctx)						\
 	({struct snd_soc_tplg_hdr *ptr;						\
+	tplg_check_bounds(ctx, hdr->payload_size);				\
 	ptr = (struct snd_soc_tplg_hdr *)(ctx->tplg_base + ctx->tplg_offset);	\
 	ctx->tplg_offset += hdr->payload_size; (void *)ptr; })


Nothing to do with this PR. These are not general purpose macros, but just a short hand in writing topology parser. The code is not even used for anything any more. So I am not going to fix all issues found from these sources.

jsarha · 2026-06-15T15:26:43Z

+#define tplg_check_bounds(ctx, advance)						\
+	do {									\
+		if ((long)(advance) < 0 ||					\
+		    ctx->tplg_offset + (long)(advance) > (long)ctx->tplg_size) { \
+			printf("%s %d topology offset %ld + %ld > size %zu\n",	\
+			       __func__, __LINE__, ctx->tplg_offset,		\
+			       (long)(advance), ctx->tplg_size);		\
+			assert(0);						\
+		}								\
+	} while (0)


Will put an exit(1) there instead.

jsarha · 2026-06-15T21:14:22Z

+		size_t cur_len = strlen(pipeline_string);
+		size_t remaining = pipeline_string_size > cur_len ?
+				   pipeline_string_size - cur_len : 0;
+		int written;
+
+		if (route_num == (count - 1))
+			written = snprintf(pipeline_string + cur_len, remaining,
+					   "%s->%s\n", graph_elem->source,
+					   graph_elem->sink);
+		else
+			written = snprintf(pipeline_string + cur_len, remaining,
+					   "%s->", graph_elem->source);
+
+		if (written < 0 || (size_t)written >= remaining)
+			fprintf(stderr, "warning: pipeline string truncated\n");


Put copilot to work, and then let it check its work, and then fix yourself.

 #define APP_NAME "sof-probes"

 #define PACKET_MAX_SIZE	4096	/**< Size limit for probe data packet */
+#define PACKET_DATA_SIZE_MAX (16 * 1024 * 1024)	/**< Sanity limit for packet data size */


lyakh · 2026-06-12T13:25:49Z

+		    ctx->tplg_offset + (long)(advance) > (long)ctx->tplg_size) { \
+			printf("%s %d topology offset %ld + %ld > size %zu\n",	\
+			       __func__, __LINE__, ctx->tplg_offset,		\
+			       (long)(advance), ctx->tplg_size);		\


ctx should be in parentheses

It is missing there is several other macros that were there before this commit. I'll adda another commit on top and fix them all in that one.

lyakh · 2026-06-12T13:27:29Z

-	({void *ptr; ptr = ctx->tplg_base + ctx->tplg_offset;			\
+	({void *ptr;								\
+	tplg_check_bounds(ctx, sizeof(*(obj)) + (priv_size));			\
+	ptr = ctx->tplg_base + ctx->tplg_offset;				\


same in these macros and below too

Add tplg_check_bounds() macro that validates ctx->tplg_offset + advance does not exceed ctx->tplg_size before advancing the offset. Apply this check in all topology object reader macros: tplg_get_hdr, tplg_skip_hdr_payload, tplg_get_object, tplg_get_object_priv, tplg_get_widget, tplg_get_graph, and tplg_get_pcm. Without these checks, a crafted .tplg file with malicious payload_size or priv.size values can drive the offset past the end of the mapped topology data, causing out-of-bounds reads in all subsequent object parsing. Signed-off-by: Jyri Sarha <jyri.sarha@intel.com>

Add () around all macro argument instances. Signed-off-by: Jyri Sarha <jyri.sarha@linux.intel.com>

Replace unbounded strcat() calls with snprintf() that tracks remaining buffer capacity. Add a pipeline_string_size parameter to tplg_create_graph() so the function knows the buffer limit. Without this fix, a crafted topology file with many or long graph element names can overflow the caller's fixed 256-byte pipeline_string buffer via repeated strcat(), corrupting the host stack. Signed-off-by: Jyri Sarha <jyri.sarha@intel.com>

…erflow Add a sanity check in process_sync() to reject packets with data_size_bytes exceeding 16 MiB before performing the data_size_bytes + sizeof(uint64_t) addition used for realloc sizing. Without this check, a crafted probe dump with data_size_bytes near UINT32_MAX wraps the realloc size to a small value, then the subsequent data copy writes data_size_bytes into the undersized buffer. Signed-off-by: Jyri Sarha <jyri.sarha@intel.com>

Copilot AI review requested due to automatic review settings June 12, 2026 11:37

jsarha requested review from dbaluta, kv2019i, lbetlej, lgirdwood, mmaka1, plbossart and ranj063 as code owners June 12, 2026 11:37

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Copilot started reviewing on behalf of jsarha June 12, 2026 11:45 View session

lyakh reviewed Jun 12, 2026

View reviewed changes

jsarha force-pushed the tplg_parser_security_fixes branch from 0e95cfa to 58d22fc Compare June 15, 2026 15:56

jsarha force-pushed the tplg_parser_security_fixes branch from 58d22fc to 08892a2 Compare June 15, 2026 21:08

Jyri Sarha added 3 commits June 16, 2026 00:15

tools: tplg_parser: Add () around all macro argument instances

da99850

Add () around all macro argument instances. Signed-off-by: Jyri Sarha <jyri.sarha@linux.intel.com>

jsarha force-pushed the tplg_parser_security_fixes branch from 08892a2 to d1ffb2b Compare June 15, 2026 21:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tplg parser security fixes#10896

Tplg parser security fixes#10896
jsarha wants to merge 4 commits into
thesofproject:mainfrom
jsarha:tplg_parser_security_fixes

jsarha commented Jun 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

jsarha Jun 15, 2026

Uh oh!

jsarha Jun 15, 2026

Uh oh!

jsarha Jun 15, 2026

Uh oh!

Uh oh!

lyakh Jun 12, 2026

Uh oh!

jsarha Jun 15, 2026

Uh oh!

lyakh Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jsarha commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jsarha Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jsarha Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jsarha Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lyakh Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

jsarha Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

lyakh Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jsarha commented Jun 12, 2026 •

edited

Loading