summaryrefslogtreecommitdiff
path: root/sound/usb/mixer.c
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-01-02 19:12:21 +0300
committerTakashi Iwai <tiwai@suse.de>2019-01-07 13:10:17 +0300
commit3e96d7280f16e2f787307f695a31296b9e4a1cd7 (patch)
tree1244aeea9be71900bf3df1620cc64c6b8eb1de03 /sound/usb/mixer.c
parent0bfe5e434e6665b3590575ec3c5e4f86a1ce51c9 (diff)
downloadlinux-3e96d7280f16e2f787307f695a31296b9e4a1cd7.tar.xz
ALSA: usb-audio: Always check descriptor sizes in parser code
There are a few places where we access the data without checking the actual object size from the USB audio descriptor. This may result in OOB access, as recently reported. This patch addresses these missing checks. Most of added codes are simple bLength checks in the caller side. For the input and output terminal parsers, we put the length check in the parser functions. For the input terminal, a new argument is added to distinguish between UAC1 and the rest, as they treat different objects. Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Reported-by: Hui Peng <benquike@163.com> Tested-by: Hui Peng <benquike@163.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb/mixer.c')
-rw-r--r--sound/usb/mixer.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index dfd918891e69..e7d441d0e839 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2075,11 +2075,15 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid,
if (state->mixer->protocol == UAC_VERSION_2) {
struct uac2_input_terminal_descriptor *d_v2 = raw_desc;
+ if (d_v2->bLength < sizeof(*d_v2))
+ return -EINVAL;
control = UAC2_TE_CONNECTOR;
term_id = d_v2->bTerminalID;
bmctls = le16_to_cpu(d_v2->bmControls);
} else if (state->mixer->protocol == UAC_VERSION_3) {
struct uac3_input_terminal_descriptor *d_v3 = raw_desc;
+ if (d_v3->bLength < sizeof(*d_v3))
+ return -EINVAL;
control = UAC3_TE_INSERTION;
term_id = d_v3->bTerminalID;
bmctls = le32_to_cpu(d_v3->bmControls);