| From d56268fb108c7c21e19933588ca4d94652585183 Mon Sep 17 00:00:00 2001 |
| From: Clemens Ladisch <clemens@ladisch.de> |
| Date: Thu, 29 Nov 2012 17:04:23 +0100 |
| Subject: ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices |
| |
| From: Clemens Ladisch <clemens@ladisch.de> |
| |
| commit d56268fb108c7c21e19933588ca4d94652585183 upstream. |
| |
| Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0) |
| forgot to adjust the length check for UAC 2.0 feature unit descriptors. |
| This would make the code abort on encountering a feature unit without |
| per-channel controls, and thus prevented the driver to work with any |
| device having such a unit, such as the RME Babyface or Fireface UCX. |
| |
| Reported-by: Florian Hanisch <fhanisch@uni-potsdam.de> |
| Tested-by: Matthew Robbetts <wingfeathera@gmail.com> |
| Tested-by: Michael Beer <beerml@sigma6audio.de> |
| Cc: Daniel Mack <daniel@caiaq.de> |
| Signed-off-by: Clemens Ladisch <clemens@ladisch.de> |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/usb/mixer.c | 17 ++++++++++++----- |
| 1 file changed, 12 insertions(+), 5 deletions(-) |
| |
| --- a/sound/usb/mixer.c |
| +++ b/sound/usb/mixer.c |
| @@ -1259,16 +1259,23 @@ static int parse_audio_feature_unit(stru |
| } |
| channels = (hdr->bLength - 7) / csize - 1; |
| bmaControls = hdr->bmaControls; |
| + if (hdr->bLength < 7 + csize) { |
| + snd_printk(KERN_ERR "usbaudio: unit %u: " |
| + "invalid UAC_FEATURE_UNIT descriptor\n", |
| + unitid); |
| + return -EINVAL; |
| + } |
| } else { |
| struct uac2_feature_unit_descriptor *ftr = _ftr; |
| csize = 4; |
| channels = (hdr->bLength - 6) / 4 - 1; |
| bmaControls = ftr->bmaControls; |
| - } |
| - |
| - if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) { |
| - snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid); |
| - return -EINVAL; |
| + if (hdr->bLength < 6 + csize) { |
| + snd_printk(KERN_ERR "usbaudio: unit %u: " |
| + "invalid UAC_FEATURE_UNIT descriptor\n", |
| + unitid); |
| + return -EINVAL; |
| + } |
| } |
| |
| /* parse the source unit */ |