tree 1ef1d716ec315970933d7c7e29a4766916d86679
parent fb65c2dfe60d38be6b9193d0b85e66e780cd4373
author Xi Wang <xi.wang@gmail.com> 1326031372 -0500
committer Takashi Iwai <tiwai@suse.de> 1326034992 +0100

ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()

A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.

Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.

To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.

This patch makes two changes.

1) The type of "rate" is changed to unsigned int, so that the loop could
   stop once "rate" is larger than INT_MAX.

2) Limit nr_rates to 1024.

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>