tools: ctl: bound csv data write against abi header size

The ascii csv branch of read_setup() advances the write index past the
32-byte abi header for -r (no_abi) input but still bounds each write with
n < n_max, while the binary branch stops at n_max - abi_size. A csv tuning
file with ctrl_size/4 values then writes sizeof(struct sof_abi_hdr) bytes
past the end of the tlv buffer.

ctrl_size is not guaranteed to be a multiple of sizeof(uint32_t) either,
so bounding the byte count alone still lets the final 4-byte store run up
to 3 bytes past the buffer. Count the csv values and stop after the last
whole uint32_t that fits in the data area, which also keeps the loop from
mixing a size in bytes with an index into a uint32_t array.

Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>

Author: jmestwa-coder

tools/ctl/ctl.c

@@ -121,7 +121,8 @@ static int read_setup(struct ctl_data *ctl_data)
 	int n = 0;
 	FILE *fh;
 	int data_start_int_index = 0;
-	int data_int_index;
+	int val_index = 0;
+	int val_max;
 
 	/* open input file */
 	fh = fdopen(ctl_data->in_fd, mode);
@@ -144,22 +145,25 @@ static int read_setup(struct ctl_data *ctl_data)
 	}
 
 	/* reading for ASCII CSV txt */
-	data_int_index = data_start_int_index;
+	/* whole uint32_t values the data area can hold, the trailing bytes of an
+	 * unaligned control size are unusable
+	 */
+	val_max = (n_max - abi_size) / (int)sizeof(uint32_t);
 	while (fscanf(fh, "%u", &x) != EOF) {
-		if (n < n_max)
-			ctl_data->buffer[data_int_index] = x;
+		if (val_index < val_max)
+			ctl_data->buffer[data_start_int_index + val_index] = x;
 
-		if (n > 0)
+		if (val_index > 0)
 			fprintf(stdout, ",");
 
 		fprintf(stdout, "%u", x);
 		separator = fgetc(fh);
 		while (separator != ',' && separator != EOF)
 			separator = fgetc(fh);
-		data_int_index++;
-		n += sizeof(uint32_t);
+		val_index++;
 	}
 
+	n = val_index * (int)sizeof(uint32_t);
 	fprintf(stdout, "\n");
 
 read_done: