diff options
| author | Takashi Iwai <[email protected]> | 2024-07-15 14:35:54 +0200 |
|---|---|---|
| committer | Takashi Iwai <[email protected]> | 2024-07-15 16:06:09 +0200 |
| commit | 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 (patch) | |
| tree | c7e89afb408dbed7fc07a8f2b0b6be0f20d63198 | |
| parent | 5fa87a081b2d633b944d5a93f5767623ef2a961d (diff) | |
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
A malformed USB descriptor may pass the lengthy mixer description with
a lot of channels, and this may overflow the 32bit integer shift
size, as caught by syzbot UBSAN test. Although this won't cause any
real trouble, it's better to address.
This patch introduces a sanity check of the number of channels to bail
out the parsing when too many channels are found.
Reported-by: [email protected]
Closes: https://lore.kernel.org/[email protected]
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
| -rw-r--r-- | sound/usb/mixer.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 409fc1164694..fd6b94b3b638 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -2014,6 +2014,13 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, bmaControls = ftr->bmaControls; } + if (channels > 32) { + usb_audio_info(state->chip, + "usbmixer: too many channels (%d) in unit %d\n", + channels, unitid); + return -EINVAL; + } + /* parse the source unit */ err = parse_audio_unit(state, hdr->bSourceID); if (err < 0) |