From 76747915c13bd6b8a070516ec8ddc361cf2228bc Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Tue, 21 Nov 2017 16:55:51 +0100 Subject: [PATCH] ALSA: usb-audio: Add sanity checks to FE parser commit d937cd6790a2bef2d07b500487646bd794c039bb upstream. When the usb-audio descriptor contains the malformed feature unit description with a too short length, the driver may access out-of-bounds. Add a sanity check of the header size at the beginning of parse_audio_feature_unit(). Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Reported-by: Andrey Konovalov Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: use snd_printk() for logging] Signed-off-by: Ben Hutchings --- sound/usb/mixer.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index a489f2fbe4d8..457cf8b39182 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1255,6 +1255,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void __u8 *bmaControls; if (state->mixer->protocol == UAC_VERSION_1) { + if (hdr->bLength < 7) { + snd_printk(KERN_ERR + "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", + unitid); + return -EINVAL; + } csize = hdr->bControlSize; if (!csize) { snd_printdd(KERN_ERR "usbaudio: unit %u: " @@ -1271,6 +1277,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void } } else { struct uac2_feature_unit_descriptor *ftr = _ftr; + if (hdr->bLength < 6) { + snd_printk(KERN_ERR + "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", + unitid); + return -EINVAL; + } csize = 4; channels = (hdr->bLength - 6) / 4 - 1; bmaControls = ftr->bmaControls; -- 2.39.5