2019-03-11 14:35:21

by Per Waagø

[permalink] [raw]
Subject: [PATCH] sbc: Fix off-by-one error in index check when unpacking frame

If trying to parse or decode a stream with a truncated packet, the
first byte past the provided data stream would be read.
---
sbc/sbc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbc/sbc.c b/sbc/sbc.c
index 7f1efaa..0f21481 100644
--- a/sbc/sbc.c
+++ b/sbc/sbc.c
@@ -499,7 +499,7 @@ static int sbc_unpack_frame_internal(const uint8_t *data,

audio_sample = 0;
for (bit = 0; bit < bits[ch][sb]; bit++) {
- if (consumed > len * 8)
+ if (consumed >= len * 8)
return -1;

if ((data[consumed >> 3] >> (7 - (consumed & 0x7))) & 0x01)
--
2.19.1



2019-03-11 14:36:38

by Per Waagø

[permalink] [raw]
Subject: Re: [PATCH] sbc: Fix off-by-one error in index check when unpacking frame

The problem can be demonstrated with the program below. Valgrind will
fail when running this program for values of short_packet_size from 12
through 113.
--
#include <sbc/sbc.h>

#include <stdlib.h>
#include <string.h>

static void encode_and_truncate_frame(uint8_t * dest, size_t dest_size)
{
sbc_t enc;
sbc_init(&enc, 0);
enc.frequency = SBC_FREQ_48000;
enc.blocks = SBC_BLK_16;
enc.subbands = SBC_SB_8;
enc.mode = SBC_MODE_STEREO;
enc.allocation = SBC_AM_LOUDNESS;
enc.bitpool = 51;
enc.endian = SBC_LE;

const size_t input_frame_size = sbc_get_codesize(&enc);
const size_t output_frame_size = sbc_get_frame_length(&enc);
uint8_t * input_frame = calloc(1, input_frame_size);
uint8_t * output_frame = calloc(1, input_frame_size);

ssize_t produced;
sbc_encode(&enc, input_frame, input_frame_size,
output_frame, output_frame_size,
&produced);

memcpy(dest, output_frame, dest_size);

free(input_frame);
free(output_frame);
sbc_finish(&enc);
}

int main(int argc, char * argv[])
{
const size_t short_packet_size = 12;
uint8_t * short_packet = malloc(short_packet_size);
encode_and_truncate_frame(short_packet, short_packet_size);

sbc_t dec;
sbc_init(&dec, 0);

sbc_parse(&dec, short_packet, short_packet_size);

sbc_finish(&dec);
free(short_packet);
return 0;
}