Commit 24617d0f authored by Johan Carlsson's avatar Johan Carlsson Committed by Yuan Can
Browse files

ALSA: usb-audio: Stop parsing channels bits when all channels are found. 

stable inclusion
from stable-v5.10.214
commit 5cd466673b34bac369334f66cbe14bb77b7d7827
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91N
CVE: CVE-2024-27436

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5cd466673b34bac369334f66cbe14bb77b7d7827



--------------------------------

If a usb audio device sets more bits than the amount of channels
it could write outside of the map array.

Signed-off-by: default avatarJohan Carlsson <johan.carlsson@teenage.engineering>
Fixes: 04324ccc ("ALSA: usb-audio: add channel map support")
Message-ID: <20240313081509.9801-1-johan.carlsson@teenage.engineering>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parent 5673bfb2

sound/usb/stream.c

+4 −1
Original line number Diff line number Diff line
@@ -305,9 +305,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, 
	c = 0;



	if (bits) {

		for (; bits && *maps; maps++, bits >>= 1)

		for (; bits && *maps; maps++, bits >>= 1) {

			if (bits & 1)

				chmap->map[c++] = *maps;

			if (c == chmap->channels)

				break;

		}

	} else {

		/* If we're missing wChannelConfig, then guess something

		    to make sure the channel map is not skipped entirely */