Commit b59d5c51 authored by Cássio Gabriel's avatar Cássio Gabriel Committed by Takashi Iwai
Browse files

ALSA: ua101: Reject too-short USB descriptors 



find_format_descriptor() walks the class-specific interface extras by
advancing with bLength. It rejects descriptors that extend past the
remaining buffer, but it does not reject descriptor lengths smaller than
a USB descriptor header.

Reject too-short descriptors before using bLength to advance the local
scan. This keeps the UA-101 parser robust against malformed descriptor
data and matches the usual USB descriptor walking rules.

Fixes: 63978ab3 ("sound: add Edirol UA-101 support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarCássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260519-alsa-ua101-desc-len-v1-1-4307d1a5e054@gmail.com


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 9e5fb609

sound/usb/misc/ua101.c

+3 −2
Original line number Diff line number Diff line
@@ -894,8 +894,9 @@ find_format_descriptor(struct usb_interface *interface) 
		struct uac_format_type_i_discrete_descriptor *desc;



		desc = (struct uac_format_type_i_discrete_descriptor *)extra;

		if (desc->bLength > extralen) {

			dev_err(&interface->dev, "descriptor overflow\n");

		if (desc->bLength < sizeof(struct usb_descriptor_header) ||

		    desc->bLength > extralen) {

			dev_err(&interface->dev, "invalid descriptor length\n");

			return NULL;

		}

		if (desc->bLength == UAC_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(1) &&