diff options
| author | Takashi Iwai <tiwai@suse.de> | 2019-01-02 17:12:21 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2019-01-07 11:10:17 +0100 |
| commit | 3e96d7280f16e2f787307f695a31296b9e4a1cd7 (patch) | |
| tree | 1244aeea9be71900bf3df1620cc64c6b8eb1de03 /sound/usb/card.c | |
| parent | 0bfe5e434e6665b3590575ec3c5e4f86a1ce51c9 (diff) | |
| download | linux-3e96d7280f16e2f787307f695a31296b9e4a1cd7.tar.gz linux-3e96d7280f16e2f787307f695a31296b9e4a1cd7.tar.bz2 linux-3e96d7280f16e2f787307f695a31296b9e4a1cd7.zip | |
ALSA: usb-audio: Always check descriptor sizes in parser code
There are a few places where we access the data without checking the
actual object size from the USB audio descriptor. This may result in
OOB access, as recently reported.
This patch addresses these missing checks. Most of added codes are
simple bLength checks in the caller side. For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reported-by: Hui Peng <benquike@163.com>
Tested-by: Hui Peng <benquike@163.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb/card.c')
| -rw-r--r-- | sound/usb/card.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/usb/card.c b/sound/usb/card.c index a105947eaf55..746a72e23cf9 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -246,7 +246,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) h1 = snd_usb_find_csint_desc(host_iface->extra, host_iface->extralen, NULL, UAC_HEADER); - if (!h1) { + if (!h1 || h1->bLength < sizeof(*h1)) { dev_err(&dev->dev, "cannot find UAC_HEADER\n"); return -EINVAL; } |