Commit d56268fb authored by Clemens Ladisch's avatar Clemens Ladisch Committed by Takashi Iwai

ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices

Commit 23caaf19 (ALSA: usb-mixer: Add support for Audio Class v2.0)
forgot to adjust the length check for UAC 2.0 feature unit descriptors.
This would make the code abort on encountering a feature unit without
per-channel controls, and thus prevented the driver to work with any
device having such a unit, such as the RME Babyface or Fireface UCX.
Reported-by: default avatarFlorian Hanisch <fhanisch@uni-potsdam.de>
Tested-by: default avatarMatthew Robbetts <wingfeathera@gmail.com>
Tested-by: default avatarMichael Beer <beerml@sigma6audio.de>
Cc: Daniel Mack <daniel@caiaq.de>
Cc: 2.6.35+ <stable@vger.kernel.org>
Signed-off-by: default avatarClemens Ladisch <clemens@ladisch.de>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 257c2a02
...@@ -1331,16 +1331,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void ...@@ -1331,16 +1331,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
} }
channels = (hdr->bLength - 7) / csize - 1; channels = (hdr->bLength - 7) / csize - 1;
bmaControls = hdr->bmaControls; bmaControls = hdr->bmaControls;
if (hdr->bLength < 7 + csize) {
snd_printk(KERN_ERR "usbaudio: unit %u: "
"invalid UAC_FEATURE_UNIT descriptor\n",
unitid);
return -EINVAL;
}
} else { } else {
struct uac2_feature_unit_descriptor *ftr = _ftr; struct uac2_feature_unit_descriptor *ftr = _ftr;
csize = 4; csize = 4;
channels = (hdr->bLength - 6) / 4 - 1; channels = (hdr->bLength - 6) / 4 - 1;
bmaControls = ftr->bmaControls; bmaControls = ftr->bmaControls;
} if (hdr->bLength < 6 + csize) {
snd_printk(KERN_ERR "usbaudio: unit %u: "
if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) { "invalid UAC_FEATURE_UNIT descriptor\n",
snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid); unitid);
return -EINVAL; return -EINVAL;
}
} }
/* parse the source unit */ /* parse the source unit */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment