sof VolumeRange Overflow

Vulnerability analysis

The SOF audio topology loader accepts mixer min and max values from a topology blob without validating them. When the max value is at or near INT_MAX, the expression max + 1 overflows, causing a far-too-small allocation for the volume table. The loader then stores the original large max value and uses it to index into the undersized table, producing an out-of-bounds write on kernel heap memory. An inverted range (min greater than max) is likewise accepted despite being nonsensical. The fix validates the complete range before any storage or allocation occurs, rejecting topology blobs where min exceeds max or where max is at or above INT_MAX. The vulnerable path is reachable locally by anyone who can supply a crafted topology to the SOF driver, which on some systems is accessible without root privileges through the audio device interface.