linux/sound/usb
Xi Wang 8866f405ef ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()
A malicious USB device could feed in a large nr_rates value.  This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.

This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-02-15 14:58:15 +01:00
..
6fire Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
caiaq Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
misc Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
usx2y Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2012-01-12 08:00:30 -08:00
card.c ALSA: module_param: make bool parameters really bool 2011-12-19 10:34:41 +01:00
card.h ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 2012-02-15 14:58:15 +01:00
clock.c
clock.h
debug.h
endpoint.c ALSA: usb-audio - Avoid flood of frame-active debug messages 2012-01-09 11:40:46 +01:00
endpoint.h
format.c ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 2012-02-15 14:58:15 +01:00
format.h
helper.c
helper.h
Kconfig
Makefile
midi.c
midi.h
mixer_maps.c
mixer_quirks.c
mixer_quirks.h
mixer.c
mixer.h
pcm.c
pcm.h
power.h
proc.c
proc.h
quirks-table.h ALSA: usb-audio: add Edirol UM-3G support 2012-02-08 09:46:34 +01:00
quirks.c ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() 2012-02-15 14:58:15 +01:00
quirks.h
stream.c
stream.h
usbaudio.h