re: kern/55919: Creative HP-BTW3 (BT-W3) USB audio device has another descriptor layout

[matthew green <mrg%eterna.com.au@localhost>]

+       while (offs < size) {
+               desc = (const void *)(tbuf + offs);

should this be "offs <= size - sizeof(*desc)"?  so that we
don't attempt to read beyond the buffer for this part, and
these should probably check the larger structure size before
deciding it's valid:

+                       asid = (const void *)desc;
+                       offs += asid->bLength;

+                       asf1d = (const void *)desc;
+                       offs += asf1d->bLength;

etc..

rest LGTM.  would be nice to have tested on many usb audio
devices :)


.mrg.