ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()

Browse source

commit f4351a199c upstream.

The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given.  Fix it by assignment after the bLength
check.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Takashi Iwai 2018-12-19 12:36:27 +01:00 • committed by Greg Kroah-Hartman

parent e189fc0441

commit 3d2a19f849

1 changed files with 8 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

sound/usb/mixer.c

View file