AZL-99621

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in sndusbmidinovation_output()

sndusbmidinovationoutput() lays out a two-byte header at transferbuffer[0..1] and passes &transferbuffer[2] together with a length of ep->maxtransfer - 2 to sndrawmiditransmit():

count = snd_rawmidi_transmit(ep->ports[0].substream,
                 &transfer_buffer[2],
                 ep->max_transfer - 2);

ep->maxtransfer comes from the output endpoint's wMaxPacketSize via usbmaxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1.

sndrawmiditransmit() passes the negative count on to _sndrawmiditransmitpeek(), where "if (count1 > count) count1 = count" leaves count1 negative; getalignedsize() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (sizet)-1 length and writes far past the transfer buffer, which was allocated with usballoccoherent(ep->maxtransfer).

This is the same class of bug that was fixed for sndusbmidiakaioutput() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.