Re: [PATCH] ALSA: usb-audio: caiaq: validate EP1 reply lengths

[Takashi Iwai]

On Sun, 05 Jul 2026 10:46:01 +0200,
Pengpeng Hou wrote:
> 
> usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then
> reads command-specific fixed items from the same URB buffer. Several
> paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that
> urb->actual_length contains those bytes.
> 
> Add per-command length checks, use a payload length derived from the
> bytes after the command byte for the control-state copy, and reject short
> analog input payloads before the input helper reads fixed offsets from
> the EP1 reply.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>

Applied now.  Thanks.


Takashi