ALSA: usb-audio: Fix endpoint-extra bounds checks in USB MIDI parsers

[PATCH 0/2] ALSA: usb-audio: Fix endpoint-extra bounds checks in USB MIDI parsers

Posted by Cássio Gabriel 1 month, 1 week ago

Both the legacy USB MIDI and USB MIDI 2.0 endpoint descriptor
walkers can return a class-specific endpoint descriptor without
first checking that bLength fits in the remaining endpoint-extra
scan.

The later parsers validate the internal flexible-array sizes
before reading baAssocJackID[] or baAssoGrpTrmBlkID[], but they
still trust the descriptor returned by the walker. A malformed
device can therefore make the parser consume bytes past
the walked descriptor span.

- Patch 1 bounds the legacy MIDI endpoint descriptor walk.
- Patch 2 applies the same fix to the MIDI 2.0 endpoint descriptor walk.

No behavior changes for valid devices; malformed endpoint-extra descriptors
are now rejected during parsing instead.

Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
---
Cássio Gabriel (2):
      ALSA: usb-audio: Bound MIDI endpoint descriptor scans
      ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

 sound/usb/midi.c  | 12 +++++++-----
 sound/usb/midi2.c | 12 +++++++-----
 2 files changed, 14 insertions(+), 10 deletions(-)
---
base-commit: 627f14c46d507a5f14a159d27c0042a6811903d6
change-id: 20260423-usb-midi-endpoint-scan-bounds-3d67b2b5f45c

Best regards,
--  
Cássio Gabriel <cassiogabrielcontato@gmail.com>

Re: [PATCH 0/2] ALSA: usb-audio: Fix endpoint-extra bounds checks in USB MIDI parsers

Posted by Takashi Iwai 1 month, 1 week ago

On Thu, 07 May 2026 05:40:50 +0200,
Cássio Gabriel wrote:
> 
> Both the legacy USB MIDI and USB MIDI 2.0 endpoint descriptor
> walkers can return a class-specific endpoint descriptor without
> first checking that bLength fits in the remaining endpoint-extra
> scan.
> 
> The later parsers validate the internal flexible-array sizes
> before reading baAssocJackID[] or baAssoGrpTrmBlkID[], but they
> still trust the descriptor returned by the walker. A malformed
> device can therefore make the parser consume bytes past
> the walked descriptor span.
> 
> - Patch 1 bounds the legacy MIDI endpoint descriptor walk.
> - Patch 2 applies the same fix to the MIDI 2.0 endpoint descriptor walk.
> 
> No behavior changes for valid devices; malformed endpoint-extra descriptors
> are now rejected during parsing instead.
> 
> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
> ---
> Cássio Gabriel (2):
>       ALSA: usb-audio: Bound MIDI endpoint descriptor scans
>       ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

Applied both to for-linus branch now.  Thanks.


Takashi