Commit fb4e2a6e authored by Youngjun Lee's avatar Youngjun Lee Committed by Takashi Iwai
Browse files

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() 



In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.

Signed-off-by: default avatarYoungjun Lee <yjjuny.lee@samsung.com>
Fixes: 9a2fe9b8 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 9a07ca9a

sound/usb/stream.c

+2 −0
Original line number Diff line number Diff line
@@ -987,6 +987,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, 
	 * and request Cluster Descriptor

	 */

	wLength = le16_to_cpu(hc_header.wLength);

	if (wLength < sizeof(cluster))

		return NULL;

	cluster = kzalloc(wLength, GFP_KERNEL);

	if (!cluster)

		return ERR_PTR(-ENOMEM);