AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

ALSA: usb-audio: Add sanity checks in UAC3 clock parsers

Browse Source 
The UAC3 clock parser codes lack of the sanity checks for malformed
descriptors like UAC2 parser does.  Without it, the driver may lead to
a potential crash.

Fixes: 9a2fe9b801 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Tested-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2018-04-03 17:45:19 +02:00
parent f5d76e9c40
commit b580fbfff1
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sound/usb/clock.c
View File

@ -58,7 +58,7 @@ static bool validate_clock_source_v2(void *p, int id)
static bool validate_clock_source_v3(void *p, int id)
{
struct uac3_clock_source_descriptor *cs = p;
return cs->bClockID == id;
return cs->bLength == sizeof(*cs) && cs->bClockID == id;
}
static bool validate_clock_selector_v2(void *p, int id)
@ -71,7 +71,8 @@ static bool validate_clock_selector_v2(void *p, int id)
static bool validate_clock_selector_v3(void *p, int id)
{
struct uac3_clock_selector_descriptor *cs = p;
return cs->bClockID == id;
return cs->bLength >= sizeof(*cs) && cs->bClockID == id &&
cs->bLength == 11 + cs->bNrInPins;
}
static bool validate_clock_multiplier_v2(void *p, int id)
@ -83,7 +84,7 @@ static bool validate_clock_multiplier_v2(void *p, int id)
static bool validate_clock_multiplier_v3(void *p, int id)
{
struct uac3_clock_multiplier_descriptor *cs = p;
return cs->bClockID == id;
return cs->bLength == sizeof(*cs) && cs->bClockID == id;
}
#define DEFINE_FIND_HELPER(name, obj, validator, type) \