Skip to contentSkip to conversation

ALSA: usb-audio: ensure that cluster header size is enough

PATCH In review Dan Carpenter 2 participants 2 messages Sep 22, 2018

Subsystems (3)
USB Sound Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ALSA: usb-audio: ensure that cluster header size is enough

I think we need a check to make sure that "hc_header.wLength" is large enough for a struct struct uac3_cluster_header_descriptor.

Fixes 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Signed-off-by Dan Carpenter <[email protected]>
sound/usb/stream.c +6 -0
index 67cf849aa16b..f7179ce39a19 100644
@@ -968,6 +968,12 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,
 	 * and request Cluster Descriptor
 	 */
 	wLength = le16_to_cpu(hc_header.wLength);
+	if (wLength < sizeof(*cluster)) {
+		dev_err(&dev->dev,
+			"%u:%d : cluster header size too small %d\n",
+			iface_no, altno, wLength);
+		return ERR_PTR(-EIO);
+	}
 	cluster = kzalloc(wLength, GFP_KERNEL);
 	if (!cluster)
 		return ERR_PTR(-ENOMEM);
#1 lore raw

Hello!

Quoted 2 lines · Dan Carpenter

I think we need a check to make sure that "hc_header.wLength" is large enough for a struct struct uac3_cluster_header_descriptor.

struct struct? :-)

Quoted 2 lines
Fixes 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Signed-off-by Dan Carpenter <[email protected]>

[...]

MBR, Sergei