]> git.baikalelectronics.ru Git - kernel.git/commit
ALSA: usb-audio: Always check descriptor sizes in parser code
authorTakashi Iwai <tiwai@suse.de>
Wed, 2 Jan 2019 16:12:21 +0000 (17:12 +0100)
committerTakashi Iwai <tiwai@suse.de>
Mon, 7 Jan 2019 10:10:17 +0000 (11:10 +0100)
commit8e295c2b82538e9a8c2d236de9bc3c5b2fa053b4
tree1244aeea9be71900bf3df1620cc64c6b8eb1de03
parent32969a319fa23194789e65e7a98774e02aabffa0
ALSA: usb-audio: Always check descriptor sizes in parser code

There are a few places where we access the data without checking the
actual object size from the USB audio descriptor.  This may result in
OOB access, as recently reported.

This patch addresses these missing checks.  Most of added codes are
simple bLength checks in the caller side.  For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.

Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reported-by: Hui Peng <benquike@163.com>
Tested-by: Hui Peng <benquike@163.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/card.c
sound/usb/mixer.c
sound/usb/stream.c