diff options
| author | Xie Xiaobo <xiaobo.xie@nxp.com> | 2017-12-12 08:12:33 (GMT) |
|---|---|---|
| committer | Xie Xiaobo <xiaobo.xie@nxp.com> | 2017-12-12 08:12:33 (GMT) |
| commit | c0246a9ec4d461ef4dd7647f94005380bb9e7f0b (patch) | |
| tree | 7588601aa6ce98f5e9fd083a1b351d9023c0b295 /sound/usb/card.c | |
| parent | 50fd1a6d79d48a7c35890aecce5a5d6b872a461d (diff) | |
| parent | 56f4a560c6d6318b5a8e18a1b3e44909a5158d1e (diff) | |
| download | linux-c0246a9ec4d461ef4dd7647f94005380bb9e7f0b.tar.xz | |
Merge Linaro linux 4.9.62 into linux-4.9
Signed-off-by: Xiaobo Xie <xiaobo.xie@nxp.com>
Diffstat (limited to 'sound/usb/card.c')
| -rw-r--r-- | sound/usb/card.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/sound/usb/card.c b/sound/usb/card.c index f36cb06..8906199 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) struct usb_interface_descriptor *altsd; void *control_header; int i, protocol; + int rest_bytes; /* find audiocontrol interface */ host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0]; @@ -235,6 +236,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) return -EINVAL; } + rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - + control_header; + + /* just to be sure -- this shouldn't hit at all */ + if (rest_bytes <= 0) { + dev_err(&dev->dev, "invalid control header\n"); + return -EINVAL; + } + switch (protocol) { default: dev_warn(&dev->dev, @@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) case UAC_VERSION_1: { struct uac1_ac_header_descriptor *h1 = control_header; + if (rest_bytes < sizeof(*h1)) { + dev_err(&dev->dev, "too short v1 buffer descriptor\n"); + return -EINVAL; + } + if (!h1->bInCollection) { dev_info(&dev->dev, "skipping empty audio interface (v1)\n"); return -EINVAL; } + if (rest_bytes < h1->bLength) { + dev_err(&dev->dev, "invalid buffer length (v1)\n"); + return -EINVAL; + } + if (h1->bLength < sizeof(*h1) + h1->bInCollection) { dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n"); return -EINVAL; |