alsa-lib Heap-Based Buffer Overflow Vulnerability in Topology Mixer Control Decoder

A heap-based buffer overflow vulnerability has been identified in alsa-lib versions 1.2.2 through 1.2.15.2, prior to commit 5f7fe33. The issue arises in the topology mixer control decoder, specifically within the tplg_decode_control_mixer1() function. This function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without proper validation against the fixed-size channel array limit. As a result, a crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to heap corruption and a crash.

Impact

Exploitation of this vulnerability causes heap corruption, which can lead to a crash of the application.

Remediation

Users can update to alsa-lib versions later than 1.2.15.2 to address this vulnerability.