From aa2341659cced0d1ecf66eed6100d942b30c3ab3 Mon Sep 17 00:00:00 2001 From: Tomasz Leman Date: Wed, 7 Oct 2026 13:50:34 +0200 Subject: [PATCH] llext-manager: reject manifests with no module segments Treat zero modules as an invalid manifest. While SOF rmalloc() returns NULL for a zero-size allocation, causing the old code to return -ENOMEM, this validation returns the appropriate -EINVAL error before allocating and prevents later n_mod - 1 indexes from depending on allocator behavior. Found by clang-analyzer-security.ArrayBound. Assisted-by: Copilot:claude-opus-5 clang-tidy Signed-off-by: Tomasz Leman --- src/library_manager/llext_manager.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/library_manager/llext_manager.c b/src/library_manager/llext_manager.c index 75a2a7295482..272191984cfb 100644 --- a/src/library_manager/llext_manager.c +++ b/src/library_manager/llext_manager.c @@ -548,6 +548,12 @@ static int llext_manager_mod_init(struct lib_manager_mod_ctx *ctx, n_mod++; } + if (!n_mod) { + tr_err(&lib_manager_tr, "no module segments in %u entries", + desc->header.num_module_entries); + return -EINVAL; + } + /* * Loadable modules are loaded to DRAM once and never unloaded from it. * Context, related to them, is never freed