alsa-lib: security hardening — UCM, conf parser, topology, PCM plugins (6 findings)

[HarshRajSinghania]

This PR addresses six independently-triggered security hardening issues found during a source audit of commit f84cd4c, all verified with proof-of-concept programs.

A3 (shell/system()) and A6 (PCM file popen) are intentional features and are not patched here — hardening suggestions noted inline for maintainer consideration.

---

A1 — UCM sysw path traversal (CWE-22) · src/ucm/main.c

execute_sysw() concatenates the sysfs root with a caller-supplied string via snprintf() with no .. rejection or realpath() confinement. A UCM path like ../../etc/cron.d/x:value writes to an arbitrary filesystem location. Fix: realpath() confinement — reject if resolved path does not remain within the sysfs root.

A2 — UCM cfg-save unrestricted path (CWE-73) · src/ucm/main.c

execute_cfgsave() calls snd_output_stdio_open(&out, file, "w+") with a raw caller-supplied file and no restriction. Any writable path (e.g. ~/.ssh/authorized_keys) is reachable. Fix: realpath() check — confine to XDG_RUNTIME_DIR (fallback /tmp).

A4 — Config parser absolute include traversal (CWE-22) · src/conf.c

input_stdio_open() immediately opens any absolute path (file[0]=='/') without checking for .. components. A planted config with </../../etc/shadow> can read arbitrary files. Fix: reject paths containing /../.

A5 — Topology control uint32_t integer overflow (CWE-190) · src/topology/ctl.c

size2 = x->size + x->priv.size is computed in 32-bit unsigned arithmetic before being widened to size_t. On a 64-bit host, 0xFFFFFFF0 + 0x20 = 0x10 (wraps), bypassing the subsequent size2 > size guard. Three sites: tplg_decode_control_mixer, tplg_decode_control_enum, tplg_decode_control_bytes (distinct from CVE-2026-25068 which was tplg_decode_control_mixer1). Fix: pre-check for overflow, then (size_t)x->size + (size_t)x->priv.size.

A7 — PCM route plugin unbounded ttable allocation (CWE-770) · src/pcm/pcm_route.c

csize/ssize grow from config-supplied channel indices with no upper bound before malloc(csize * ssize * sizeof(entry)). Index 1073741823 → malloc(8 GB). Fix: cap both at 1024 (consistent with dmix, softvol, other PCM plugins).

A8 — PCM multi sparse bindings OOB assert (CWE-617) · src/pcm/pcm_multi.c

Sparse binding maps leave sidxs[i] == -1 for gap indices. assert(schannels[i] < schannels_count[sidxs[i]]) then dereferences schannels_count[-1] → SIGABRT (debug) / OOB read (NDEBUG). Fix: replace both assert()s with explicit -EINVAL returns with bounds and sign checks.

---

Verified: all six PoC programs confirmed on libasound2 1.2.14 / gcc 14.2, commit f84cd4c.

Signed-off-by: Harsh Raj Singhania raj.harshraut@gmail.com

[tiwai]

Like your another PR, all issues look independent, so could you rather split the changes to individual commits instead of squashing into one?

[HarshRajSinghania]

Thanks @tiwai — done. The changes are now split into individual commits instead of one squashed commit:

1. conf: reject absolute include paths containing /../
2. topology: fix uint32_t overflow in control decoder size checks
3. pcm: cap route plugin ttable channel dimensions at 1024
4. pcm: replace multi plugin binding asserts with -EINVAL checks
5. ucm: confine sysw and cfg-save paths with realpath()

Please take another look when you have a moment.

[perexg]

There is issue with the last commit, the XDG_RUNTIME_DIR assumption is wrong:

ucm2/lib/card-init.conf:Define.LibDir "/var/lib/alsa/card${CardNumber}.conf.d"
ucm2/common/pcm/hdmi.conf:		cfg-save "${var:LibDir}/${var:__Name}.conf:hdmi-pcm"
ucm2/lib/ctl-remap.conf:	cfg-save "${var:LibDir}/ctl-remap.conf:+ctl.default"

[perexg]

Also, I find realpath() checks too expensive, perhaps '/../' check would be okay like in f5377bb .

[tiwai]

OK, then let's scratch the last one. Others can remain, right?