diff options
| author | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2019-03-28 14:32:06 +0100 |
|---|---|---|
| committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2019-03-28 14:32:06 +0100 |
| commit | 32aca03c2ce868d3412da0bb6ce6798c7bea357e (patch) | |
| tree | 01630dc4a6935df99bf7d11d34ff8d384fed86e2 /sound/usb/mixer.c | |
| parent | cfbbc7703fff59c67761c93a8b1de29a79f9841c (diff) | |
| parent | 60771fc402877163d07569addadcf18b86acb455 (diff) | |
Merge tag 'v4.9.166' into 4.9-2.3.x-imx
This is the 4.9.166 stable release
Diffstat (limited to 'sound/usb/mixer.c')
| -rw-r--r-- | sound/usb/mixer.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index db8404e31fae..64b90b8ec661 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1882,7 +1882,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, char *name) { struct uac_processing_unit_descriptor *desc = raw_desc; - int num_ins = desc->bNrInPins; + int num_ins; struct usb_mixer_elem_info *cval; struct snd_kcontrol *kctl; int i, err, nameid, type, len; @@ -1897,7 +1897,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, 0, NULL, default_value_info }; - if (desc->bLength < 13 || desc->bLength < 13 + num_ins || + if (desc->bLength < 13) { + usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid); + return -EINVAL; + } + + num_ins = desc->bNrInPins; + if (desc->bLength < 13 + num_ins || desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) { usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid); return -EINVAL; |