summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorClemens Ladisch <clemens@ladisch.de>2012-11-29 17:04:23 +0100
committerTakashi Iwai <tiwai@suse.de>2013-01-27 10:22:56 +0100
commitd56268fb108c7c21e19933588ca4d94652585183 (patch)
tree38fe26d4706bfd45de4718730bd82ff52e2c0f8a
parent257c2a02a8f668ea195bcb56eebbddc1af718e5e (diff)
downloadlinux-3.10-d56268fb108c7c21e19933588ca4d94652585183.tar.gz
linux-3.10-d56268fb108c7c21e19933588ca4d94652585183.tar.bz2
linux-3.10-d56268fb108c7c21e19933588ca4d94652585183.zip
ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices
Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0) forgot to adjust the length check for UAC 2.0 feature unit descriptors. This would make the code abort on encountering a feature unit without per-channel controls, and thus prevented the driver to work with any device having such a unit, such as the RME Babyface or Fireface UCX. Reported-by: Florian Hanisch <fhanisch@uni-potsdam.de> Tested-by: Matthew Robbetts <wingfeathera@gmail.com> Tested-by: Michael Beer <beerml@sigma6audio.de> Cc: Daniel Mack <daniel@caiaq.de> Cc: 2.6.35+ <stable@vger.kernel.org> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/usb/mixer.c17
1 files changed, 12 insertions, 5 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index ed4d89c8b52..e90daf8cdaa 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1331,16 +1331,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
}
channels = (hdr->bLength - 7) / csize - 1;
bmaControls = hdr->bmaControls;
+ if (hdr->bLength < 7 + csize) {
+ snd_printk(KERN_ERR "usbaudio: unit %u: "
+ "invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
} else {
struct uac2_feature_unit_descriptor *ftr = _ftr;
csize = 4;
channels = (hdr->bLength - 6) / 4 - 1;
bmaControls = ftr->bmaControls;
- }
-
- if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) {
- snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid);
- return -EINVAL;
+ if (hdr->bLength < 6 + csize) {
+ snd_printk(KERN_ERR "usbaudio: unit %u: "
+ "invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
}
/* parse the source unit */