Message ID | 20190830001351.3686-4-connor.kuehl@canonical.com |
---|---|
State | New |
Headers | show |
Series | [X/B,SRU,CVE-2019-15117,1/2] ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit | expand |
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index ee6871ebd936..713020741289 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1700,6 +1700,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, int pin, ich, err; if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) || + desc->bLength < sizeof(*desc) + desc->bNrInPins || !(num_outs = uac_mixer_unit_bNrChannels(desc))) { usb_audio_err(state->chip, "invalid MIXER UNIT descriptor %d\n",