Subject: Re: [PATCH] sbc: Fix off-by-one error in index check when unpacking
 frame
To:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
References: <20190311142535.92501-1-pwaago@cisco.com>
From:   =?UTF-8?Q?Per_Waag=c3=b8?= <pwaago@cisco.com>
Message-ID: <d1930fe4-070d-df7e-b5a8-027748710df8@cisco.com>
Date:   Mon, 11 Mar 2019 15:26:52 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.1
MIME-Version: 1.0
In-Reply-To: <20190311142535.92501-1-pwaago@cisco.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

The problem can be demonstrated with the program below. Valgrind will 
fail when running this program for values of short_packet_size from 12 
through 113.
--
#include <sbc/sbc.h>

#include <stdlib.h>
#include <string.h>

static void encode_and_truncate_frame(uint8_t * dest, size_t dest_size)
{
     sbc_t enc;
     sbc_init(&enc, 0);
     enc.frequency = SBC_FREQ_48000;
     enc.blocks = SBC_BLK_16;
     enc.subbands = SBC_SB_8;
     enc.mode = SBC_MODE_STEREO;
     enc.allocation = SBC_AM_LOUDNESS;
     enc.bitpool = 51;
     enc.endian = SBC_LE;

     const size_t input_frame_size = sbc_get_codesize(&enc);
     const size_t output_frame_size = sbc_get_frame_length(&enc);
     uint8_t * input_frame = calloc(1, input_frame_size);
     uint8_t * output_frame = calloc(1, input_frame_size);

     ssize_t produced;
     sbc_encode(&enc, input_frame, input_frame_size,
         output_frame, output_frame_size,
         &produced);

     memcpy(dest, output_frame, dest_size);

     free(input_frame);
     free(output_frame);
     sbc_finish(&enc);
}

int main(int argc, char * argv[])
{
     const size_t short_packet_size = 12;
     uint8_t * short_packet = malloc(short_packet_size);
     encode_and_truncate_frame(short_packet, short_packet_size);

     sbc_t dec;
     sbc_init(&dec, 0);

     sbc_parse(&dec, short_packet, short_packet_size);

     sbc_finish(&dec);
     free(short_packet);
     return 0;
}