diff options
| author | Takashi Iwai <tiwai@suse.de> | 2017-11-21 17:07:43 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2017-11-21 17:50:32 +0100 |
| commit | 8428a8ebde2db1e988e41a58497a28beb7ce1705 (patch) | |
| tree | 5bd2f5a3c9d60d7f8166c170a8f2649cb5201ff7 /sound | |
| parent | ALSA: usb-audio: Fix potential out-of-bound access at parsing SU (diff) | |
| download | linux-8428a8ebde2db1e988e41a58497a28beb7ce1705.tar.xz linux-8428a8ebde2db1e988e41a58497a28beb7ce1705.zip | |
ALSA: usb-audio: Fix potential zero-division at parsing FU
parse_audio_feature_unit() contains a code dividing potentially with
zero when a malformed FU descriptor is passed. Although there is
already a sanity check, it checks only the value zero, hence it can
still lead to a zero-division when a value 1 is passed there.
Fix it by correcting the sanity check (and the error message
thereof).
Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/mixer.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 61b348383de8..0537c6322990 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1476,9 +1476,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, return -EINVAL; } csize = hdr->bControlSize; - if (!csize) { + if (csize <= 1) { usb_audio_dbg(state->chip, - "unit %u: invalid bControlSize == 0\n", + "unit %u: invalid bControlSize <= 1\n", unitid); return -EINVAL; } |