ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()

Browse source

commit f4351a199c upstream.

The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given.  Fix it by assignment after the bLength
check.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

...

This commit is contained in:

Takashi Iwai 2018-12-19 12:36:27 +01:00 • committed by Ben Hutchings

parent b1c840e32d

commit cacb39e5e4

1 changed files with 8 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

sound/usb/mixer.c

View file