Commit 918be519 authored by Cássio Gabriel's avatar Cássio Gabriel Committed by Takashi Iwai
Browse files

ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans 



The USB MIDI 2.0 endpoint parser has the same descriptor walking
pattern as the legacy MIDI parser. It validates bLength against
bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the
remaining bytes in the endpoint-extra scan.

A malformed device can therefore make later baAssoGrpTrmBlkID[] reads
consume bytes past the walked descriptor.

Reject zero-length and overlong descriptors while walking endpoint
extras.

Fixes: ff49d1df ("ALSA: usb-audio: USB MIDI 2.0 UMP support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarCássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-2-329d7348160e@gmail.com


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent d6854daa

sound/usb/midi2.c

+7 −5
Original line number Diff line number Diff line
@@ -496,15 +496,17 @@ static void *find_usb_ms_endpoint_descriptor(struct usb_host_endpoint *hostep, 
	while (extralen > 3) {

		struct usb_ms_endpoint_descriptor *ms_ep =

			(struct usb_ms_endpoint_descriptor *)extra;

		int length = ms_ep->bLength;



		if (ms_ep->bLength > 3 &&

		if (!length || length > extralen)

			break;



		if (length > 3 &&

		    ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT &&

		    ms_ep->bDescriptorSubtype == subtype)

			return ms_ep;

		if (!extra[0])

			break;

		extralen -= extra[0];

		extra += extra[0];

		extralen -= length;

		extra += length;

	}

	return NULL;

}