Commit 89f0adde authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: usb-audio: Fix size validation in convert_chmap_v3() 



The "p" pointer is void so sizeof(*p) is 1.  The intent was to check
sizeof(*cs_desc), which is 3, instead.

Fixes: ecfd4116 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent c0ed3c2e

sound/usb/stream.c

+1 −1
Original line number Diff line number Diff line
@@ -349,7 +349,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor 
		u16 cs_len;

		u8 cs_type;



		if (len < sizeof(*p))

		if (len < sizeof(*cs_desc))

			break;

		cs_len = le16_to_cpu(cs_desc->wLength);

		if (len < cs_len)