ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

[PATCH] ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

Takashi Iwai posted 1 patch 1 month, 2 weeks ago

Download mbox

sound/usb/stream.c | 2 ++
1 file changed, 2 insertions(+)

Expand all Fold all

[PATCH] ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

Posted by Takashi Iwai 1 month, 2 weeks ago

The convert_chmap_v3() has a loop with its increment size of
cs_len->wLength, but we forgot to validate cs_desc->wLength itself,
which may lead to potential endless loop by a malformed descriptor.

Add a proper size check to abort the loop for plugging the hole.

Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/usb/stream.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index f8f56ace5652..b2c5c8198281 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -353,6 +353,8 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor
 		if (len < sizeof(*cs_desc))
 			break;
 		cs_len = le16_to_cpu(cs_desc->wLength);
+		if (cs_len < sizeof(*cs_desc))
+			break;
 		if (len < cs_len)
 			break;
 		cs_type = cs_desc->bSegmentType;
-- 
2.54.0