| From d937cd6790a2bef2d07b500487646bd794c039bb Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Tue, 21 Nov 2017 16:55:51 +0100 |
| Subject: ALSA: usb-audio: Add sanity checks to FE parser |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit d937cd6790a2bef2d07b500487646bd794c039bb upstream. |
| |
| When the usb-audio descriptor contains the malformed feature unit |
| description with a too short length, the driver may access |
| out-of-bounds. Add a sanity check of the header size at the beginning |
| of parse_audio_feature_unit(). |
| |
| Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") |
| Reported-by: Andrey Konovalov <andreyknvl@google.com> |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/usb/mixer.c | 12 ++++++++++++ |
| 1 file changed, 12 insertions(+) |
| |
| --- a/sound/usb/mixer.c |
| +++ b/sound/usb/mixer.c |
| @@ -1373,6 +1373,12 @@ static int parse_audio_feature_unit(stru |
| __u8 *bmaControls; |
| |
| if (state->mixer->protocol == UAC_VERSION_1) { |
| + if (hdr->bLength < 7) { |
| + usb_audio_err(state->chip, |
| + "unit %u: invalid UAC_FEATURE_UNIT descriptor\n", |
| + unitid); |
| + return -EINVAL; |
| + } |
| csize = hdr->bControlSize; |
| if (!csize) { |
| usb_audio_dbg(state->chip, |
| @@ -1390,6 +1396,12 @@ static int parse_audio_feature_unit(stru |
| } |
| } else { |
| struct uac2_feature_unit_descriptor *ftr = _ftr; |
| + if (hdr->bLength < 6) { |
| + usb_audio_err(state->chip, |
| + "unit %u: invalid UAC_FEATURE_UNIT descriptor\n", |
| + unitid); |
| + return -EINVAL; |
| + } |
| csize = 4; |
| channels = (hdr->bLength - 6) / 4 - 1; |
| bmaControls = ftr->bmaControls; |
