diff options
| author | Clemens Ladisch <clemens@ladisch.de> | 2012-11-29 17:04:23 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2013-02-06 04:33:48 +0000 |
| commit | f18cd12608855fa17d94bfd30fbdaf5abf56f053 (patch) | |
| tree | 831ec11ce246e4afac9f45439eb855d2bb669cab /sound | |
| parent | 79654e81bbd146017c8cd55aa9e88b668cf385e9 (diff) | |
| download | linux-stable-f18cd12608855fa17d94bfd30fbdaf5abf56f053.tar.gz linux-stable-f18cd12608855fa17d94bfd30fbdaf5abf56f053.tar.bz2 linux-stable-f18cd12608855fa17d94bfd30fbdaf5abf56f053.zip | |
ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices
commit d56268fb108c7c21e19933588ca4d94652585183 upstream.
Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0)
forgot to adjust the length check for UAC 2.0 feature unit descriptors.
This would make the code abort on encountering a feature unit without
per-channel controls, and thus prevented the driver to work with any
device having such a unit, such as the RME Babyface or Fireface UCX.
Reported-by: Florian Hanisch <fhanisch@uni-potsdam.de>
Tested-by: Matthew Robbetts <wingfeathera@gmail.com>
Tested-by: Michael Beer <beerml@sigma6audio.de>
Cc: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/mixer.c | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 6730a33639e7..9121dee7c4db 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1239,16 +1239,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void } channels = (hdr->bLength - 7) / csize - 1; bmaControls = hdr->bmaControls; + if (hdr->bLength < 7 + csize) { + snd_printk(KERN_ERR "usbaudio: unit %u: " + "invalid UAC_FEATURE_UNIT descriptor\n", + unitid); + return -EINVAL; + } } else { struct uac2_feature_unit_descriptor *ftr = _ftr; csize = 4; channels = (hdr->bLength - 6) / 4 - 1; bmaControls = ftr->bmaControls; - } - - if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) { - snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid); - return -EINVAL; + if (hdr->bLength < 6 + csize) { + snd_printk(KERN_ERR "usbaudio: unit %u: " + "invalid UAC_FEATURE_UNIT descriptor\n", + unitid); + return -EINVAL; + } } /* parse the source unit */ |