| Date | Mon, 12 Feb 2018 07:59:51 +0100 | From | Takashi Iwai <> | Subject | Re: [PATCH 3.2 57/79] ALSA: usb-audio: Fix potential zero-division at parsing FU |
| |
On Sun, 11 Feb 2018 05:20:06 +0100, Ben Hutchings wrote: > > 3.2.99-rc1 review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Takashi Iwai <tiwai@suse.de> > > commit 8428a8ebde2db1e988e41a58497a28beb7ce1705 upstream.
Please drop this. This patch is broken, and was reverted in the later commit 3c02a6d94665.
thanks,
Takashi
> > parse_audio_feature_unit() contains a code dividing potentially with > zero when a malformed FU descriptor is passed. Although there is > already a sanity check, it checks only the value zero, hence it can > still lead to a zero-division when a value 1 is passed there. > > Fix it by correcting the sanity check (and the error message > thereof). > > Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") > Signed-off-by: Takashi Iwai <tiwai@suse.de> > [bwh: Backported to 3.2: adjust context] > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> > --- > sound/usb/mixer.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > --- a/sound/usb/mixer.c > +++ b/sound/usb/mixer.c > @@ -1262,9 +1262,9 @@ static int parse_audio_feature_unit(stru > return -EINVAL; > } > csize = hdr->bControlSize; > - if (!csize) { > + if (csize <= 1) { > snd_printdd(KERN_ERR "usbaudio: unit %u: " > - "invalid bControlSize == 0\n", unitid); > + "invalid bControlSize <= 1\n", unitid); > return -EINVAL; > } > channels = (hdr->bLength - 7) / csize - 1; >
|