diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index e29ee5363f13..8236760464b1 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1716,7 +1716,7 @@ static struct procunit_info extunits[] = { static int build_audio_procunit(struct mixer_build *state, int unitid, void *raw_desc, struct procunit_info *list, char *name) { struct uac_processing_unit_descriptor *desc = raw_desc; - int num_ins = desc->bNrInPins; + int num_ins; struct usb_mixer_elem_info *cval; struct snd_kcontrol *kctl; int i, err, nameid, type, len; @@ -1731,7 +1731,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, void *raw 0, NULL, default_value_info }; - if (desc->bLength < 13 || desc->bLength < 13 + num_ins || + if (desc->bLength < 13) { + snd_printk(KERN_ERR "invalid %s descriptor (id %d)\n", name, unitid); + return -EINVAL; + } + + num_ins = desc->bNrInPins; + if (desc->bLength < 13 + num_ins || desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) { snd_printk(KERN_ERR "invalid %s descriptor (id %d)\n", name, unitid); return -EINVAL;