[alsa-devel] [PATCH 1/5] ALSA: usbaudio: parse USB descriptors with structs

[Takashi Iwai]

At Mon, 22 Feb 2010 23:49:09 +0100,
Daniel Mack wrote:
> 
> @@ -278,7 +280,6 @@ static void *find_audio_control_unit(struct mixer_build *state, unsigned char un
>  {
>  	unsigned char *p;
>  
> -	p = NULL;
>  	while ((p = snd_usb_find_desc(state->buffer, state->buflen, p,
>  				      USB_DT_CS_INTERFACE)) != NULL) {
>  		if (p[0] >= 4 && p[2] >= INPUT_TERMINAL && p[2] <= EXTENSION_UN
IT && p[3] == unit)

This causes the random pointer access.


> @@ -1800,15 +1802,14 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
>  		}
>  	}
>  
> -	desc = NULL;
>  	while ((desc = snd_usb_find_csint_desc(hostif->extra, hostif->extralen, desc, OUTPUT_TERMINAL)) != NULL) {

Ditto.


thanks,

Takashi