Commit b09d2fdb6a for qemu.org

commit b09d2fdb6a31c5b47343eded43a52f6d8a6d03b8
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:25 2026 +0400

    audio/audio-mixeng-be: add upper bounds to audio settings validation

    Reject channel counts above 16 and sample rates above 384 kHz in
    audio_validate_settings(). Without upper bounds, extreme values can
    cause excessive memory allocation or arithmetic overflow downstream.

    Reported-by: Hui Peng <benquike@gmail.com>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-11-ccbef537cbeb@redhat.com>

diff --git a/audio/audio-mixeng-be.c b/audio/audio-mixeng-be.c
index f7d73d8560..f6fd5014e0 100644
--- a/audio/audio-mixeng-be.c
+++ b/audio/audio-mixeng-be.c
@@ -78,7 +78,7 @@ static int audio_validate_settings (const struct audsettings *as)
 {
     int invalid;

-    invalid = as->nchannels < 1;
+    invalid = as->nchannels < 1 || as->nchannels > 16;

     switch (as->fmt) {
     case AUDIO_FORMAT_S8:
@@ -94,7 +94,7 @@ static int audio_validate_settings (const struct audsettings *as)
         break;
     }

-    invalid |= as->freq <= 0;
+    invalid |= as->freq <= 0 || as->freq > 384000;
     return invalid ? -1 : 0;
 }