ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
commit 0f886ca12765d20124bd06291c82951fd49a33be upstream. create_fixed_stream_quirk() may cause a NULL-pointer dereference by accessing the non-existing endpoint when a USB device with a malformed USB descriptor is used. This patch avoids it simply by adding a sanity check of bNumEndpoints before the accesses. Change-Id: I94025f3eec256347b50805b388940774e559dae2 Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 Signed-off-by: Takashi Iwai <tiwai@suse.de> [bwh: Backported to 3.2: - There's no altsd variable - Adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> CVE-2016-2184 Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
parent
321340e9fa
commit
858824a332
|
@ -165,6 +165,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
|
|||
return -EINVAL;
|
||||
}
|
||||
alts = &iface->altsetting[fp->altset_idx];
|
||||
if (get_iface_desc(alts)->bNumEndpoints < 1) {
|
||||
kfree(fp);
|
||||
kfree(rate_table);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
fp->datainterval = snd_usb_parse_datainterval(chip, alts);
|
||||
fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
|
||||
usb_set_interface(chip->dev, fp->iface, 0);
|
||||
|
|
Loading…
Reference in New Issue