From: Xi Wang Date: Sun, 8 Jan 2012 14:02:52 +0000 (-0500) Subject: ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range() X-Git-Tag: v3.3-rc1~88^2~1^2~11 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fa0e81b83503900be277e6273a79651b375e288;p=pandora-kernel.git ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range() A malicious USB device may feed in carefully crafted min/max/res values, so that the inner loop in parse_uac2_sample_rate_range() could run for a long time or even never terminate, e.g., given max = INT_MAX. Also nr_rates could be a large integer, which causes an integer overflow in the subsequent call to kmalloc() in parse_audio_format_rates_v2(). Thus, kmalloc() would allocate a smaller buffer than expected, leading to a memory corruption. To exploit the two vulnerabilities, an attacker needs physical access to the machine to plug in a malicious USB device. This patch makes two changes. 1) The type of "rate" is changed to unsigned int, so that the loop could stop once "rate" is larger than INT_MAX. 2) Limit nr_rates to 1024. Suggested-by: Takashi Iwai Signed-off-by: Xi Wang Signed-off-by: Takashi Iwai --- Reading git-diff-tree failed