diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index e77d8f561d1f..62dadee624fe 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1334,6 +1334,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void __u8 *bmaControls; if (state->mixer->protocol == UAC_VERSION_1) { + if (hdr->bLength < 7) { + snd_printk(KERN_ERR + "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", + unitid); + return -EINVAL; + } csize = hdr->bControlSize; if (!csize) { snd_printdd(KERN_ERR "usbaudio: unit %u: " @@ -1350,6 +1356,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void } } else { struct uac2_feature_unit_descriptor *ftr = _ftr; + if (hdr->bLength < 6) { + snd_printk(KERN_ERR + "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", + unitid); + return -EINVAL; + } csize = 4; channels = (hdr->bLength - 6) / 4 - 1; bmaControls = ftr->bmaControls;