Junrui Luo 1e1b3207a5 ALSA: dice: fix buffer overflow in detect_stream_formats() ...

commit 324f3e03e8 upstream.

The function detect_stream_formats() reads the stream_count value directly
from a FireWire device without validating it. This can lead to
out-of-bounds writes when a malicious device provides a stream_count value
greater than MAX_STREAMS.

Fix by applying the same validation to both TX and RX stream counts in
detect_stream_formats().

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 58579c056c ("ALSA: dice: use extended protocol to detect available stream formats")
Cc: stable@vger.kernel.org
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881B043FC68B4C0DA40B73DAFDCA@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-12-18 14:03:42 +01:00

..

bebob

ALSA: firewire: bebob: Use guard() for spin locks

2025-08-30 10:02:21 +02:00

dice

ALSA: dice: fix buffer overflow in detect_stream_formats()

2025-12-18 14:03:42 +01:00

digi00x

ALSA: firewire: digi00x: Use guard() for spin locks

2025-08-30 10:02:21 +02:00

fireface

ALSA: firewire: fireface: Use guard() for spin locks

2025-08-30 10:02:21 +02:00

fireworks

ALSA: firewire: fireworks: Use guard() for spin locks

2025-08-30 10:02:22 +02:00

motu

ALSA: firewire-motu: add bounds check in put_user loop for DSP events

2025-12-18 14:03:39 +01:00

oxfw

ALSA: firewire: oxfw: Use guard() for spin locks

2025-08-30 10:02:27 +02:00

tascam

ALSA: firewire: tascam: Use guard() for spin locks

2025-08-30 10:02:27 +02:00

amdtp-am824.c

ALSA: firewire-lib: obsolete return value from context payload processing layer

2023-01-12 12:14:50 +01:00

amdtp-am824.h

ALSA: firewire-lib/motu: use int type for the value of bitwise OR with enumerator-constant

2021-05-18 12:21:52 +02:00

amdtp-stream-trace.h

ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI

2023-01-10 09:34:47 +01:00

amdtp-stream.c

ALSA: firewire: lib: Use guard() for mutex locks

2025-08-30 10:02:21 +02:00

amdtp-stream.h

ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings

2025-10-14 15:12:52 +02:00

cmp.c

ALSA: firewire: lib: Use guard() for mutex locks

2025-08-30 10:02:21 +02:00

cmp.h

ALSA: firewire: Remove unused cmp_connection_update

2024-10-10 14:22:01 +02:00

fcp.c

ALSA: firewire: lib: Use guard() for spin locks

2025-08-30 10:02:27 +02:00

fcp.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

isight.c

ALSA: firewire: isight: Use guard() for mutex locks

2025-08-30 10:02:21 +02:00

iso-resources.c

ALSA: firewire: lib: Use guard() for spin locks

2025-08-30 10:02:27 +02:00

iso-resources.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

ALSA: firewire-motu: add support for MOTU 896 mk3 FireWire and Hybrid

2024-01-29 09:04:30 +01:00

lib.c

ALSA: firewire: use 'GPL' string for module license contributed by Clemens Ladisch

2023-06-12 14:39:00 +02:00

lib.h

ALSA: firewire-lib: delete unused kernel API

2021-06-07 17:14:54 +02:00

Makefile

ALSA: firewire: Use *-y instead of *-objs in Makefile

2024-05-08 18:18:03 +02:00

packets-buffer.c

ALSA: firewire: fix a memory leak bug

2019-08-08 11:12:26 +02:00

packets-buffer.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00