ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput()

ALSA: usb-audio: Clamp frame size in implicit-feedback mode

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the remaining bytes in the endpoint-extra scan.

A malformed device can therefore make later baAssoGrpTrmBlkID[] reads consume bytes past the walked descriptor.

Reject zero-length and overlong descriptors while walking endpoint extras.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential memory leaks at error path for UMP open

The allocation and initialization errors at allocmidiurbs() that is called at MIDI 2.0 / UMP device are supposed to be handled at the caller side by invoking freemidiurbs(). However, freemidiurbs() loops only for ep->numurbs entries, and since ep->numentries wasn't updated yet at the allocation / init error in allocmidiurbs(), this entry won't be released.

The intention of freemidiurbs() is to release the whole elements, so change the loop size to NUMURBS to scan over all elements for fixing the missed releases.

Also, the call of freemidiurbs() is missing at sndusbmidiv2open(). Although it'll be released later at reopen/close or disconnection, it's better to release immediately at the error path.