ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

The USB MIDI 2.0 endpoint parser has the same descriptor walking
pattern as the legacy MIDI parser. It validates bLength against
bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the
remaining bytes in the endpoint-extra scan.

A malformed device can therefore make later baAssoGrpTrmBlkID[] reads
consume bytes past the walked descriptor.

Reject zero-length and overlong descriptors while walking endpoint
extras.

Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-2-329d7348160e@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/usb/midi2.c b/sound/usb/midi2.c
index 2785600d23124ae65735df20a0c2f23385f87a0a..04aeb9052f139e804a5d956920211bdd685c8861 100644 (file)
--- a/sound/usb/midi2.c
+++ b/sound/usb/midi2.c
@@ -496,15 +496,17 @@ static void *find_usb_ms_endpoint_descriptor(struct usb_host_endpoint *hostep,
        while (extralen > 3) {
                struct usb_ms_endpoint_descriptor *ms_ep =
                        (struct usb_ms_endpoint_descriptor *)extra;
+               int length = ms_ep->bLength;
 
-               if (ms_ep->bLength > 3 &&
+               if (!length || length > extralen)
+                       break;
+
+               if (length > 3 &&
                    ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT &&
                    ms_ep->bDescriptorSubtype == subtype)
                        return ms_ep;
-               if (!extra[0])
-                       break;
-               extralen -= extra[0];
-               extra += extra[0];
+               extralen -= length;
+               extra += length;
        }
        return NULL;
 }