lkml.org 
[lkml]   [2020]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 37/49] ALSA: usb-audio: Fix potential out-of-bounds shift
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 43d5ca88dfcd35e43010fdd818e067aa9a55f5ba upstream.

    syzbot spotted a potential out-of-bounds shift in the USB-audio format
    parser that receives the arbitrary shift value from the USB
    descriptor.

    Add a range check for avoiding the undefined behavior.

    Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20201209084552.17109-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/usb/format.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/sound/usb/format.c
    +++ b/sound/usb/format.c
    @@ -40,6 +40,8 @@ static u64 parse_audio_format_i_type(str
    case UAC_VERSION_1:
    default: {
    struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
    + if (format >= 64)
    + return 0; /* invalid format */
    sample_width = fmt->bBitResolution;
    sample_bytes = fmt->bSubframeSize;
    format = 1ULL << format;

    \
     
     \ /
      Last update: 2020-12-19 14:05    [W:4.761 / U:0.816 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site