ALSA: usb-audio: Fix size validation in convert_chmap_v3()

jira jira VULN-152933
jira jira VULN-152934
cve-bf CVE-2025-39757
commit-author Dan Carpenter <dan.carpenter@linaro.org>
commit 89f0add

The "p" pointer is void so sizeof(*p) is 1.  The intent was to check
sizeof(*cs_desc), which is 3, instead.

Fixes: ecfd411 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors")
	Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain
	Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit 89f0add)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

sound/usb/stream.c

@@ -344,7 +344,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor
 		u16 cs_len;
 		u8 cs_type;
 
-		if (len < sizeof(*p))
+		if (len < sizeof(*cs_desc))
 			break;
 		cs_len = le16_to_cpu(cs_desc->wLength);
 		if (len < cs_len)