[PATCH 4.19 105/148] ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()

[Greg Kroah-Hartman]

4.19-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <ti...@suse.de>

commit f4351a199cc120ff9d59e06d02e8657d08e6cc46 upstream.

The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given.  Fix it by assignment after the bLength
check.

Cc: <sta...@vger.kernel.org>
Signed-off-by: Takashi Iwai <ti...@suse.de>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 sound/usb/mixer.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2314,7 +2314,7 @@ static int build_audio_procunit(struct m
                                char *name)
 {
        struct uac_processing_unit_descriptor *desc = raw_desc;
-       int num_ins = desc->bNrInPins;
+       int num_ins;
        struct usb_mixer_elem_info *cval;
        struct snd_kcontrol *kctl;
        int i, err, nameid, type, len;
@@ -2329,7 +2329,13 @@ static int build_audio_procunit(struct m
                0, NULL, default_value_info
        };
 
-       if (desc->bLength < 13 || desc->bLength < 13 + num_ins ||
+       if (desc->bLength < 13) {
+               usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", 
name, unitid);
+               return -EINVAL;
+       }
+
+       num_ins = desc->bNrInPins;
+       if (desc->bLength < 13 + num_ins ||
            desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, 
state->mixer->protocol)) {
                usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", 
name, unitid);
                return -EINVAL;