In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
sndusbhandlesyncurb() scales received sync packet sizes by the sender's stride and stores the result directly in outpacket->packetsize[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize.
The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits.
Cap the calculated frame count against ep->maxframesize in sndusbhandlesyncurb() to prevent oversized packets from entering the playback queue.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the remaining bytes in the endpoint-extra scan.
A malformed device can therefore make later baAssoGrpTrmBlkID[] reads consume bytes past the walked descriptor.
Reject zero-length and overlong descriptors while walking endpoint extras.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix potential memory leaks at error path for UMP open
The allocation and initialization errors at allocmidiurbs() that is called at MIDI 2.0 / UMP device are supposed to be handled at the caller side by invoking freemidiurbs(). However, freemidiurbs() loops only for ep->numurbs entries, and since ep->numentries wasn't updated yet at the allocation / init error in allocmidiurbs(), this entry won't be released.
The intention of freemidiurbs() is to release the whole elements, so change the loop size to NUMURBS to scan over all elements for fixing the missed releases.
Also, the call of freemidiurbs() is missing at sndusbmidiv2open(). Although it'll be released later at reopen/close or disconnection, it's better to release immediately at the error path.
ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput()