Skip to content

Conversation

@cujomalainey
Copy link
Contributor

ubsan found the following bug via oss-fuzz

/src/sof/src/ipc/handler.c:1385:9: runtime error: left shift of 15 by 28 places cannot be represented in type 'int'

This is caused by SOF_GLB_TYPE_MASK which has an implicit length of 15
(int16_t)

Signed-off-by: Curtis Malainey cujomalainey@chromium.org

@lgirdwood
Copy link
Member

CI showing what looks like a CI failure.

Copy link
Member

@lgirdwood lgirdwood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@plbossart @kv2019i this will be needed in kernel too.

@lgirdwood lgirdwood added the ABI ABI change involved label Oct 22, 2020
@lgirdwood lgirdwood added this to the v1.6 milestone Oct 22, 2020
@cujomalainey
Copy link
Contributor Author

FYI this is blocking oss-fuzz integration as this crashes the fuzzer on first iteration everytime

@cujomalainey
Copy link
Contributor Author

Related kernel PR is here, I spotted another overflow just by code inspection, will update this PR as well

ubsan found the following bug via oss-fuzz

/src/sof/src/ipc/handler.c:1385:9: runtime error: left shift of 15 by 28 places cannot be represented in type 'int'

This is caused by SOF_GLB_TYPE_MASK which has an implicit length of 15
(int16_t)

Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
@lgirdwood lgirdwood merged commit 6cd9f6a into thesofproject:master Oct 23, 2020
@lgirdwood
Copy link
Member

@cujomalainey is there a similar kernel fix ?

@cujomalainey
Copy link
Contributor Author

@lgirdwood see link in last comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ABI ABI change involved

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants