Commit b272bf3
committed
copier: fix NULL converter crash for non-zero sink_queue_id
Fix NULL pointer dereference in copier when sink buffer IDs map to
non-zero sink_queue_id values but converters are not initialized.
The issue occurs when IPC4_SINK_QUEUE_ID(buf_get_id(sink)) extracts a
non-zero queue ID from a sink buffer's ID, but copier_prepare() only
initializes converter[0]. This causes crashes in do_conversion_copy()
when accessing cd->converter[i] for i != 0.
This can happen even in single sink scenarios where the buffer ID
encoding results in sink_queue_id=1 instead of the expected 0.
The fix enhances copier_prepare() to:
- Iterate through all connected sink buffers
- Extract the actual sink_queue_id for each buffer
- Initialize converters for the queue IDs that are actually used
- Skip redundant initialization if converter already exists
- Provide proper error handling for out-of-range queue IDs
Resolves crashes in topologies where single sink copiers have buffers
with non-zero queue ID mappings.
Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>1 parent 4d898ff commit b272bf3
1 file changed
Lines changed: 32 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
344 | 344 | | |
345 | 345 | | |
346 | 346 | | |
| 347 | + | |
| 348 | + | |
347 | 349 | | |
348 | 350 | | |
349 | 351 | | |
350 | 352 | | |
351 | | - | |
352 | | - | |
| 353 | + | |
| 354 | + | |
353 | 355 | | |
354 | 356 | | |
355 | 357 | | |
356 | 358 | | |
357 | 359 | | |
| 360 | + | |
| 361 | + | |
| 362 | + | |
| 363 | + | |
| 364 | + | |
| 365 | + | |
| 366 | + | |
| 367 | + | |
| 368 | + | |
| 369 | + | |
| 370 | + | |
| 371 | + | |
| 372 | + | |
| 373 | + | |
| 374 | + | |
| 375 | + | |
| 376 | + | |
| 377 | + | |
| 378 | + | |
| 379 | + | |
| 380 | + | |
| 381 | + | |
| 382 | + | |
| 383 | + | |
| 384 | + | |
| 385 | + | |
| 386 | + | |
| 387 | + | |
358 | 388 | | |
359 | 389 | | |
360 | 390 | | |
| |||
0 commit comments