@@ -254,6 +254,13 @@ int tplg_load_pcm(int comp_id, int pipeline_id, int size, int dir,
254254 if (ret != 1 )
255255 return - EINVAL ;
256256
257+ /* check for array size mismatch */
258+ if (!is_valid_priv_size (total_array_size , size , array )) {
259+ fprintf (stderr , "error: load pcm array size mismatch\n" );
260+ free (array );
261+ return - EINVAL ;
262+ }
263+
257264 ret = tplg_read_array (array , file );
258265 if (ret ) {
259266 fprintf (stderr , "error: read array fail\n" );
@@ -322,6 +329,13 @@ int tplg_load_dai(int comp_id, int pipeline_id, int size,
322329 return - EINVAL ;
323330 }
324331
332+ /* check for array size mismatch */
333+ if (!is_valid_priv_size (total_array_size , size , array )) {
334+ fprintf (stderr , "error: load dai array size mismatch\n" );
335+ free (array );
336+ return - EINVAL ;
337+ }
338+
325339 ret = tplg_read_array (array , file );
326340 if (ret ) {
327341 fprintf (stderr , "error: read array fail\n" );
@@ -458,14 +472,21 @@ int tplg_load_pipeline(int comp_id, int pipeline_id, int size,
458472 read_size = sizeof (struct snd_soc_tplg_vendor_array );
459473 ret = fread (array , read_size , 1 , file );
460474 if (ret != 1 ) {
461- free (array );
475+ free ((void * )array - total_array_size );
476+ return - EINVAL ;
477+ }
478+
479+ /* check for array size mismatch */
480+ if (!is_valid_priv_size (total_array_size , size , array )) {
481+ fprintf (stderr , "error: load pipeline array size mismatch\n" );
482+ free ((void * )array - total_array_size );
462483 return - EINVAL ;
463484 }
464485
465486 ret = tplg_read_array (array , file );
466487 if (ret ) {
467488 fprintf (stderr , "error: read array fail\n" );
468- free (array );
489+ free (( void * ) array - total_array_size );
469490 return - EINVAL ;
470491 }
471492
@@ -476,7 +497,7 @@ int tplg_load_pipeline(int comp_id, int pipeline_id, int size,
476497 if (ret != 0 ) {
477498 fprintf (stderr , "error: parse pipeline tokens %d\n" ,
478499 size );
479- free (array );
500+ free (( void * ) array - total_array_size );
480501 return - EINVAL ;
481502 }
482503
@@ -827,6 +848,13 @@ int tplg_load_src(int comp_id, int pipeline_id, int size,
827848 return - EINVAL ;
828849 }
829850
851+ /* check for array size mismatch */
852+ if (!is_valid_priv_size (total_array_size , size , array )) {
853+ fprintf (stderr , "error: load src array size mismatch\n" );
854+ free (array );
855+ return - EINVAL ;
856+ }
857+
830858 ret = tplg_read_array (array , file );
831859 if (ret ) {
832860 fprintf (stderr , "error: read array fail\n" );
@@ -899,6 +927,13 @@ int tplg_load_asrc(int comp_id, int pipeline_id, int size,
899927 return - EINVAL ;
900928 }
901929
930+ /* check for array size mismatch */
931+ if (!is_valid_priv_size (total_array_size , size , array )) {
932+ fprintf (stderr , "error: load asrc array size mismatch\n" );
933+ free (array );
934+ return - EINVAL ;
935+ }
936+
902937 ret = tplg_read_array (array , file );
903938 if (ret ) {
904939 fprintf (stderr , "error: read array fail\n" );
@@ -972,6 +1007,13 @@ int tplg_load_process(int comp_id, int pipeline_id, int size,
9721007 return - EINVAL ;
9731008 }
9741009
1010+ /* check for array size mismatch */
1011+ if (!is_valid_priv_size (total_array_size , size , array )) {
1012+ fprintf (stderr , "error: load process array size mismatch\n" );
1013+ free (array );
1014+ return - EINVAL ;
1015+ }
1016+
9751017 ret = tplg_read_array (array , file );
9761018 if (ret ) {
9771019 fprintf (stderr , "error: read array fail\n" );
@@ -1045,6 +1087,13 @@ int tplg_load_mixer(int comp_id, int pipeline_id, int size,
10451087 return - EINVAL ;
10461088 }
10471089
1090+ /* check for array size mismatch */
1091+ if (!is_valid_priv_size (total_array_size , size , array )) {
1092+ fprintf (stderr , "error: load mixer array size mismatch\n" );
1093+ free (array );
1094+ return - EINVAL ;
1095+ }
1096+
10481097 ret = tplg_read_array (array , file );
10491098 if (ret ) {
10501099 fprintf (stderr , "error: read array fail\n" );
0 commit comments