diff options
| author | Arnaldo Carvalho de Melo <acme@redhat.com> | 2021-05-21 15:59:23 -0300 |
|---|---|---|
| committer | Arnaldo Carvalho de Melo <acme@redhat.com> | 2021-05-21 15:59:23 -0300 |
| commit | f248d687e99da6799a25bbf53ca1350b84d41077 (patch) | |
| tree | edb0b90c039e34e838329ca4d96e9888a4ebfa34 /sound/usb/midi.c | |
| parent | 3b2f17ad1770e51b8b4e68b5069c4f1ee477eff8 (diff) | |
| parent | 011ff616ffe8df6b86ee54d14a43c8d1a96a6325 (diff) | |
| download | linux-f248d687e99da6799a25bbf53ca1350b84d41077.tar.gz linux-f248d687e99da6799a25bbf53ca1350b84d41077.tar.bz2 linux-f248d687e99da6799a25bbf53ca1350b84d41077.zip | |
Merge remote-tracking branch 'torvalds/master' into perf/urgent
To pick up more UAPI updates to sync with tools/.
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'sound/usb/midi.c')
| -rw-r--r-- | sound/usb/midi.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/sound/usb/midi.c b/sound/usb/midi.c index a10ac75969a8..2c01649c70f6 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1750,7 +1750,7 @@ static struct usb_midi_in_jack_descriptor *find_usb_in_jack_descriptor( struct usb_midi_in_jack_descriptor *injd = (struct usb_midi_in_jack_descriptor *)extra; - if (injd->bLength > 4 && + if (injd->bLength >= sizeof(*injd) && injd->bDescriptorType == USB_DT_CS_INTERFACE && injd->bDescriptorSubtype == UAC_MIDI_IN_JACK && injd->bJackID == jack_id) @@ -1773,7 +1773,7 @@ static struct usb_midi_out_jack_descriptor *find_usb_out_jack_descriptor( struct usb_midi_out_jack_descriptor *outjd = (struct usb_midi_out_jack_descriptor *)extra; - if (outjd->bLength > 4 && + if (outjd->bLength >= sizeof(*outjd) && outjd->bDescriptorType == USB_DT_CS_INTERFACE && outjd->bDescriptorSubtype == UAC_MIDI_OUT_JACK && outjd->bJackID == jack_id) @@ -1820,7 +1820,8 @@ static void snd_usbmidi_init_substream(struct snd_usb_midi *umidi, outjd = find_usb_out_jack_descriptor(hostif, jack_id); if (outjd) { sz = USB_DT_MIDI_OUT_SIZE(outjd->bNrInputPins); - iJack = *(((uint8_t *) outjd) + sz - sizeof(uint8_t)); + if (outjd->bLength >= sz) + iJack = *(((uint8_t *) outjd) + sz - sizeof(uint8_t)); } } else { /* and out jacks connect to ins */ @@ -1956,8 +1957,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, ms_ep = find_usb_ms_endpoint_descriptor(hostep); if (!ms_ep) continue; + if (ms_ep->bLength <= sizeof(*ms_ep)) + continue; if (ms_ep->bNumEmbMIDIJack > 0x10) continue; + if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) + continue; if (usb_endpoint_dir_out(ep)) { if (endpoints[epidx].out_ep) { if (++epidx >= MIDI_MAX_ENDPOINTS) { |