1 files changed, 5 insertions, 1 deletions

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a3ddac0deffd..27817266867a 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -132,10 +132,14 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
         unsigned *rate_table = NULL;
 
         fp = kmemdup(quirk->data, sizeof(*fp), GFP_KERNEL);
-        if (! fp) {
+        if (!fp) {
                 snd_printk(KERN_ERR "cannot memdup\n");
                 return -ENOMEM;
         }
+        if (fp->nr_rates > MAX_NR_RATES) {
+                kfree(fp);
+                return -EINVAL;
+        }
         if (fp->nr_rates > 0) {
                 rate_table = kmemdup(fp->rate_table,
                                      sizeof(int) * fp->nr_rates, GFP_KERNEL);