ALSA: usb-audio: Fix potential out-of-bounds shift

syzbot spotted a potential out-of-bounds shift in the USB-audio format parser that receives the arbitrary shift value from the USB descriptor. Add a range check for avoiding the undefined behavior. Reported-by: [email protected] Cc: <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Takashi Iwai <[email protected]>
ashr · Dec 14, 2020 · 43d5ca8 · 43d5ca8
1 parent e5fab13
commit 43d5ca8
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/sound/usb/format.c b/sound/usb/format.c
@@ -39,6 +39,8 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip,
 	case UAC_VERSION_1:
 	default: {
 		struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+		if (format >= 64)
+			return 0; /* invalid format */
 		sample_width = fmt->bBitResolution;
 		sample_bytes = fmt->bSubframeSize;
 		format = 1ULL << format;