Re: [RFC PATCH] ASoC: Intel: avs: Fix reading 1 or more bytes from a region of size 0

[Takashi Iwai <tiwai@suse.de>]

On Tue, 02 Sep 2025 10:08:12 +0200,
Brahmajit Das wrote:
> 
> Building the next tree with GCC 16, results in the following error:
> 
> sound/soc/intel/avs/path.c:137:38: error: ‘strcmp’ reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread]
>   137 |         return id->id == id2->id && !strcmp(id->tplg_name, id2->tplg_name);
>       |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In file included from sound/soc/intel/avs/path.h:14,
>                  from sound/soc/intel/avs/path.c:15:
> sound/soc/intel/avs/topology.h: In function ‘avs_condpaths_walk’:
> sound/soc/intel/avs/topology.h:150:13: note: at offset 4 into source object ‘id’ of size 4
>   150 |         u32 id;
>       |             ^~
> sound/soc/intel/avs/topology.h:150:13: note: at offset 4 into source object ‘id’ of size 4
> 
> I'm not quite sure if this is a GCC bug or a problem with the source
> code.
> As an workaround, instead of using strcmp, strncmp helps. But would
> really appriciate comments from developers as I'm sure there might be a
> better way to fix this.
> 
> Introduced by commit 595b7f155b926 ("ASoC: Intel: avs: Conditional-path
> support")
> 
> Signed-off-by: Brahmajit Das <listout@listout.xyz>
> ---
>  sound/soc/intel/avs/path.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/soc/intel/avs/path.c b/sound/soc/intel/avs/path.c
> index 7aa20fcf1a33..8c3df2002b58 100644
> --- a/sound/soc/intel/avs/path.c
> +++ b/sound/soc/intel/avs/path.c
> @@ -134,7 +134,8 @@ static struct avs_tplg_path *avs_condpath_find_variant(struct avs_dev *adev,
>  static bool avs_tplg_path_template_id_equal(struct avs_tplg_path_template_id *id,
>  					    struct avs_tplg_path_template_id *id2)
>  {
> -	return id->id == id2->id && !strcmp(id->tplg_name, id2->tplg_name);
> +	return id->id == id2->id &&
> +	       !strncmp(id->tplg_name, id2->tplg_name, strlen(id->tplg_name));

Please use sizeof()-1 instead of strlen(), as it's a fixed size array.

Practically seen, it's likely a false-positive from the new compiler.
But it's still safer to add the boundary check in the code itself.


thanks,

Takashi