Re: [PATCH] Fix an OOB bug in parse_audio_mixer_unit

2019-08-14 Thread Takashi Iwai
On Wed, 14 Aug 2019 18:52:07 +0200, 彭辉 wrote: > > Hi, Takashi: > > Thanks for the guide. > The new patch is confirmed and attached. Thanks, applied now. Takashi

Re: [PATCH] Fix an OOB bug in parse_audio_mixer_unit

2019-08-14 Thread Takashi Iwai
On Wed, 14 Aug 2019 18:28:39 +0200, 彭辉 wrote: > > Hi, Takashi: > Here the problem is that `desc->bLength` is controlled by the device side, > so  `desc->bLength` may not represent the real length of the descriptor. > That is why I use pointer arithmetic operations to derive the real size of the >

Re: [PATCH] Fix an OOB bug in parse_audio_mixer_unit

2019-08-14 Thread Takashi Iwai
On Wed, 14 Aug 2019 11:09:21 +0200, Dan Carpenter wrote: > > On Wed, Aug 14, 2019 at 08:36:42AM +0200, Takashi Iwai wrote: > > On Wed, 14 Aug 2019 04:36:24 +0200, > > Hui Peng wrote: > > > > > > The `uac_mixer_unit_descriptor` shown as below is read from the > > > device side. In `parse_audio_mix

Re: [PATCH] Fix an OOB bug in parse_audio_mixer_unit

2019-08-14 Thread Dan Carpenter
On Wed, Aug 14, 2019 at 08:36:42AM +0200, Takashi Iwai wrote: > On Wed, 14 Aug 2019 04:36:24 +0200, > Hui Peng wrote: > > > > The `uac_mixer_unit_descriptor` shown as below is read from the > > device side. In `parse_audio_mixer_unit`, `baSourceID` field is > > accessed from index 0 to `bNrInPins`

Re: [PATCH] Fix an OOB bug in parse_audio_mixer_unit

2019-08-13 Thread Takashi Iwai
On Wed, 14 Aug 2019 04:36:24 +0200, Hui Peng wrote: > > The `uac_mixer_unit_descriptor` shown as below is read from the > device side. In `parse_audio_mixer_unit`, `baSourceID` field is > accessed from index 0 to `bNrInPins` - 1, the current implementation > assumes that descriptor is always valid

[PATCH] Fix an OOB bug in parse_audio_mixer_unit

2019-08-13 Thread Hui Peng
The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`)