UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.
Unified · Split
| @@ -221,6 +221,17 @@ static bool validate_uac3_feature_unit(const void *p, · 220 unmodified lines | ||
| 221 | 221 | return d->bLength >= sizeof(*d) + 4 + 2; |
| 222 | 222 | } |
| 223 | 223 | |
| 224 | +static bool validate_uac3_power_domain_unit(const void *p, | |
| 225 | + const struct usb_desc_validator *v) | |
| 226 | +{ | |
| 227 | + const struct uac3_power_domain_descriptor *d = p; | |
| 228 | + | |
| 229 | + if (d->bLength < sizeof(*d)) | |
| 230 | + return false; | |
| 231 | + /* baEntities[] + wPDomainDescrStr */ | |
| 232 | + return d->bLength >= sizeof(*d) + d->bNrEntities + 2; | |
| 233 | +} | |
| 234 | + | |
| 224 | 235 | static bool validate_midi_out_jack(const void *p, |
| 225 | 236 | const struct usb_desc_validator *v) |
| 226 | 237 | { |
| @@ -285,6 +296,7 @@ static const struct usb_desc_validator audio_validators[] = { · 58 unmodified lines | ||
| 285 | 296 | struct uac3_clock_multiplier_descriptor), |
| 286 | 297 | /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */ |
| 287 | 298 | /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */ |
| 299 | + FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit), | |
| 288 | 300 | { } /* terminator */ |
| 289 | 301 | }; |
| 290 | 302 | |