From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Mon, 18 Aug 2025 09:59:45 +0000 (+0300)
Subject: ALSA: usb-audio: Fix size validation in convert_chmap_v3()
X-Git-Tag: v6.16.4~65
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5ff4ad5f3eeb89188b75510985781fb6b77f2e8d;p=thirdparty%2Fkernel%2Fstable.git

ALSA: usb-audio: Fix size validation in convert_chmap_v3()

[ Upstream commit 89f0addeee3cb2dc49837599330ed9c4612f05b0 ]

The "p" pointer is void so sizeof(*p) is 1.  The intent was to check
sizeof(*cs_desc), which is 3, instead.

Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 1cb52373e70f6..db2c9bac00adc 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -349,7 +349,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor
 		u16 cs_len;
 		u8 cs_type;
 
-		if (len < sizeof(*p))
+		if (len < sizeof(*cs_desc))
 			break;
 		cs_len = le16_to_cpu(cs_desc->wLength);
 		if (len < cs_len)