mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-10-31 18:09:19 +00:00
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
commit f4351a199cc120ff9d59e06d02e8657d08e6cc46 upstream. The parser for the processing unit reads bNrInPins field before the bLength sanity check, which may lead to an out-of-bound access when a malformed descriptor is given. Fix it by assignment after the bLength check. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
0bdf775e4d
commit
05e00017c0
1 changed files with 8 additions and 2 deletions
|
@ -1716,7 +1716,7 @@ static struct procunit_info extunits[] = {
|
|||
static int build_audio_procunit(struct mixer_build *state, int unitid, void *raw_desc, struct procunit_info *list, char *name)
|
||||
{
|
||||
struct uac_processing_unit_descriptor *desc = raw_desc;
|
||||
int num_ins = desc->bNrInPins;
|
||||
int num_ins;
|
||||
struct usb_mixer_elem_info *cval;
|
||||
struct snd_kcontrol *kctl;
|
||||
int i, err, nameid, type, len;
|
||||
|
@ -1731,7 +1731,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, void *raw
|
|||
0, NULL, default_value_info
|
||||
};
|
||||
|
||||
if (desc->bLength < 13 || desc->bLength < 13 + num_ins ||
|
||||
if (desc->bLength < 13) {
|
||||
snd_printk(KERN_ERR "invalid %s descriptor (id %d)\n", name, unitid);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
num_ins = desc->bNrInPins;
|
||||
if (desc->bLength < 13 + num_ins ||
|
||||
desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) {
|
||||
snd_printk(KERN_ERR "invalid %s descriptor (id %d)\n", name, unitid);
|
||||
return -EINVAL;
|
||||
|
|
Loading…
Reference in a new issue