kevin/linux
1
Fork 0
Code
589876e243
linux/sound/usb
History
Xi Wang 8866f405ef ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 
A malicious USB device could feed in a large nr_rates value.  This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.

This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-02-15 14:58:15 +01:00
..
6fire Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
caiaq Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
misc Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
usx2y Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
card.c ALSA: module_param: make bool parameters really bool 2011-12-19 10:34:41 +01:00
card.h ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 2012-02-15 14:58:15 +01:00
clock.c ALSA: usb-audio: increase control transfer timeout 2011-09-27 09:21:48 +02:00
clock.h ALSA: usb-audio: simplify control interface access 2010-06-23 16:10:23 +02:00
debug.h ALSA: usb-audio: make hwc_debug a noop in case HW_CONST_DEBUG is not set 2011-05-18 11:44:35 +02:00
endpoint.c ALSA: usb-audio - Avoid flood of frame-active debug messages 2012-01-09 11:40:46 +01:00
endpoint.h ALSA: snd-usb: move code from urb.c to endpoint.c 2011-09-14 17:07:03 +02:00
format.c ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 2012-02-15 14:58:15 +01:00
format.h ALSA: usb-audio: parse more format descriptors with structs 2010-05-27 09:48:31 +02:00
helper.c ALSA: usb-audio: increase control transfer timeout 2011-09-27 09:21:48 +02:00
helper.h ALSA: usb-audio: increase control transfer timeout 2011-09-27 09:21:48 +02:00
Kconfig ALSA: snd-usb-caiaq: Add support for Maschine 2011-10-13 08:16:46 +02:00
Makefile ALSA: snd-usb: move code from urb.c to endpoint.c 2011-09-14 17:07:03 +02:00
midi.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00
midi.h ALSA: usb-audio: add support for Akai MPD16 2010-05-21 17:12:30 +02:00
mixer_maps.c ALSA: usb-audio: unify constants from specification 2010-05-31 18:17:22 +02:00
mixer_quirks.c ALSA: usb-audio: increase control transfer timeout 2011-09-27 09:21:48 +02:00
mixer_quirks.h ALSA: usb-mixer: factor out quirks 2010-03-12 12:20:26 +01:00
mixer.c ALSA: snd_usb_audio: add Logitech HD Webcam c510 to quirk-384 2011-11-09 12:22:38 +01:00
mixer.h ALSA: snd-usb: operate on given mixer interface only 2011-08-04 16:24:10 +02:00
pcm.c ALSA: usb-audio: increase control transfer timeout 2011-09-27 09:21:48 +02:00
pcm.h ALSA: usb: refine delay information with USB frame counter 2011-09-12 10:30:20 +02:00
power.h ALSA: usbaudio: implement USB autosuspend 2011-03-11 14:59:29 +01:00
proc.c ALSA: usb-audio: automatically detect feedback format 2010-10-27 09:17:41 +02:00
proc.h ALSA: usb-audio: refactor code 2010-03-05 08:17:14 +01:00
quirks-table.h ALSA: usb-audio: add Edirol UM-3G support 2012-02-08 09:46:34 +01:00
quirks.c ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 2012-02-15 14:58:15 +01:00
quirks.h ALSA: usb-audio: refactor code 2010-03-05 08:17:14 +01:00
stream.c ALSA: snd-usb: move code from urb.c to endpoint.c 2011-09-14 17:07:03 +02:00
stream.h ALSA: snd-usb: re-order code 2011-09-14 17:07:02 +02:00
usbaudio.h ALSA: usb-audio: add Starr Labs USB MIDI support 2011-08-26 14:12:34 +02:00