From a36b4c71e0e4aa4d34d1a88330d3622883d8f65c Mon Sep 17 00:00:00 2001 From: Syed Mohammed Nayyar Date: Sat, 4 Jul 2026 00:28:08 +0530 Subject: [PATCH] tools: ctl: bound csv data write against abi header size The ascii csv branch of read_setup() advances the write index past the 32-byte abi header for -r (no_abi) input but still bounds each write with n < n_max, while the binary branch stops at n_max - abi_size. A csv tuning file with ctrl_size/4 values then writes sizeof(struct sof_abi_hdr) bytes past the end of the tlv buffer. Bound the csv write the same way. Signed-off-by: Syed Mohammed Nayyar --- tools/ctl/ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/ctl/ctl.c b/tools/ctl/ctl.c index c669349b68f9..b675a340401b 100644 --- a/tools/ctl/ctl.c +++ b/tools/ctl/ctl.c @@ -146,7 +146,7 @@ static int read_setup(struct ctl_data *ctl_data) /* reading for ASCII CSV txt */ data_int_index = data_start_int_index; while (fscanf(fh, "%u", &x) != EOF) { - if (n < n_max) + if (n < n_max - abi_size) ctl_data->buffer[data_int_index] = x; if (n > 0)