ALSA: usb-audio: Stop parsing channels bits when all channels are found.

[ Upstream commit a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 ]

If a usb audio device sets more bits than the amount of channels
it could write outside of the map array.

Signed-off-by: Johan Carlsson <johan.carlsson@teenage.engineering>
Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support")
Message-ID: <20240313081509.9801-1-johan.carlsson@teenage.engineering>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index c4f4585f9b851ef255408dca6424abba3647f02d..f51e901a9689ecad750b0e34ca93d3a005510238 100644 (file)
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -301,9 +301,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
        c = 0;
 
        if (bits) {
-               for (; bits && *maps; maps++, bits >>= 1)
+               for (; bits && *maps; maps++, bits >>= 1) {
                        if (bits & 1)
                                chmap->map[c++] = *maps;
+                       if (c == chmap->channels)
+                               break;
+               }
        } else {
                /* If we're missing wChannelConfig, then guess something
                    to make sure the channel map is not skipped entirely */