ALSA: usb-audio: Fix size validation in convert_chmap_v3()

The "p" pointer is void so sizeof(*p) is 1.  The intent was to check
sizeof(*cs_desc), which is 3, instead.

Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index acf3dc2d79e09f12f8ed1c1560c4e291c2606b39..5c235a5ba7e1b1ebd1b749c9cc4c64d9aa84c73b 100644 (file)
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -349,7 +349,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor
                u16 cs_len;
                u8 cs_type;
 
-               if (len < sizeof(*p))
+               if (len < sizeof(*cs_desc))
                        break;
                cs_len = le16_to_cpu(cs_desc->wLength);
                if (len < cs_len)