| commit | beab6f305f4f271caa500170d7fed1d2bda6ea88 | [log] [tgz] |
|---|---|---|
| author | Takashi Iwai <tiwai@suse.de> | Wed Dec 19 12:36:27 2018 +0100 |
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | Sun Jan 13 10:03:52 2019 +0100 |
| tree | f0056fccd4545654e578ab2378dfbe048df3a039 | |
| parent | 4cdad05eb6f773be68ae6b2686f933033b80f5a4 [diff] |
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() commit f4351a199cc120ff9d59e06d02e8657d08e6cc46 upstream. The parser for the processing unit reads bNrInPins field before the bLength sanity check, which may lead to an out-of-bound access when a malformed descriptor is given. Fix it by assignment after the bLength check. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>