diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index e1c205a6126..9f06b6c075c 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1428,7 +1428,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r int input_pins, num_ins, num_outs; int pin, ich, err; - if (desc->bLength < 11 || ! (input_pins = desc->bNrInPins) || ! (num_outs = uac_mixer_unit_bNrChannels(desc))) { + if (desc->bLength < 11 || ! (input_pins = desc->bNrInPins) || + desc->bLength < sizeof(*desc) + desc->bNrInPins || + !(num_outs = uac_mixer_unit_bNrChannels(desc))) { snd_printk(KERN_ERR "invalid MIXER UNIT descriptor %d\n", unitid); return -EINVAL; }