Skip to content

pcm_converter: reject out-of-range channel map at runtime #10918

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lgirdwood wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −15
Open

pcm_converter: reject out-of-range channel map at runtime #10918

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 20 additions & 15 deletions src/audio/pcm_converter/pcm_remap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,13 +68,14 @@ static int remap_c16(const struct audio_stream *source, uint32_t dummy1,
src_channel = chmap & 0xf;
chmap >>= 4;

if (src_channel == 0xf) {
/* 0xf means "mute"; also mute any out-of-range source channel so
* a crafted chmap nibble cannot index past the source frame.
*/
if (src_channel == 0xf || src_channel >= num_src_channels) {
mute_channel_c16(sink, sink_channel, frames);
continue;
}
Comment on lines +71 to 77

@jsarha jsarha Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot has a point, but in any case this is an improvement over earlier state of things.


assert(src_channel < num_src_channels);

src = (int16_t *)audio_stream_get_rptr(source) + src_channel;
dst = (int16_t *)audio_stream_get_wptr(sink) + sink_channel;

Expand Down Expand Up @@ -126,13 +127,14 @@ static inline int remap_c32_left_shift(const struct audio_stream *source,
src_channel = chmap & 0xf;
chmap >>= 4;

if (src_channel == 0xf) {
/* 0xf means "mute"; also mute any out-of-range source channel so
* a crafted chmap nibble cannot index past the source frame.
*/
if (src_channel == 0xf || src_channel >= num_src_channels) {
mute_channel_c32(sink, sink_channel, frames);
continue;
}

assert(src_channel < num_src_channels);

src = (int32_t *)audio_stream_get_rptr(source) + src_channel;
dst = (int32_t *)audio_stream_get_wptr(sink) + sink_channel;

Expand Down Expand Up @@ -184,13 +186,14 @@ static inline int remap_c32_right_shift(const struct audio_stream *source,
src_channel = chmap & 0xf;
chmap >>= 4;

if (src_channel == 0xf) {
/* 0xf means "mute"; also mute any out-of-range source channel so
* a crafted chmap nibble cannot index past the source frame.
*/
if (src_channel == 0xf || src_channel >= num_src_channels) {
mute_channel_c32(sink, sink_channel, frames);
continue;
}

assert(src_channel < num_src_channels);

src = (int32_t *)audio_stream_get_rptr(source) + src_channel;
dst = (int32_t *)audio_stream_get_wptr(sink) + sink_channel;

Expand Down Expand Up @@ -243,13 +246,14 @@ static inline int remap_c16_to_c32(const struct audio_stream *source,
src_channel = chmap & 0xf;
chmap >>= 4;

if (src_channel == 0xf) {
/* 0xf means "mute"; also mute any out-of-range source channel so
* a crafted chmap nibble cannot index past the source frame.
*/
if (src_channel == 0xf || src_channel >= num_src_channels) {
mute_channel_c32(sink, sink_channel, frames);
continue;
}

assert(src_channel < num_src_channels);

src = (int16_t *)audio_stream_get_rptr(source) + src_channel;
dst = (int32_t *)audio_stream_get_wptr(sink) + sink_channel;

Expand Down Expand Up @@ -302,13 +306,14 @@ static inline int remap_c32_to_c16(const struct audio_stream *source,
src_channel = chmap & 0xf;
chmap >>= 4;

if (src_channel == 0xf) {
/* 0xf means "mute"; also mute any out-of-range source channel so
* a crafted chmap nibble cannot index past the source frame.
*/
if (src_channel == 0xf || src_channel >= num_src_channels) {
mute_channel_c16(sink, sink_channel, frames);
continue;
}

assert(src_channel < num_src_channels);

src = (int32_t *)audio_stream_get_rptr(source) + src_channel;
dst = (int16_t *)audio_stream_get_wptr(sink) + sink_channel;

Expand Down
Loading