Re: [PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit

2019-09-02 Thread Greg Kroah-Hartman
On Fri, Aug 30, 2019 at 05:49:59PM -0400, Hui Peng wrote: > This is the backported patch of the following bug to v4.4.x and v4.14.x: > daac07156b33 ("ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit") Thanks, also now queued up to 4.9.y, you forgot that one :) greg k-h

Re: [PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit

2019-09-01 Thread Hui Peng
. Can you apply it to these 2 versions? (it applies to both versions) Thanks. > Regards, > Salvatore >From 09942398a53bbe730264b782673890d4a54068d0 Mon Sep 17 00:00:00 2001 From: Hui Peng Date: Fri, 30 Aug 2019 16:11:00 -0400 Subject: [PATCH 1/2] Fix an OOB bug in parse_audio_mixer

Re: [PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit

2019-09-01 Thread Salvatore Bonaccorso
On Fri, Aug 30, 2019 at 05:46:49PM -0400, Hui Peng wrote: > The `uac_mixer_unit_descriptor` shown as below is read from the > device side. In `parse_audio_mixer_unit`, `baSourceID` field is > accessed from index 0 to `bNrInPins` - 1, the current implementation > assumes that descriptor is always va

[PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit

2019-08-30 Thread Hui Peng
The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`)