[PATCH 1/1] sbc: Fix stack overflow read in sbc_crc8.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



When encoding or decoding with JOINT_STEREO and 8 subbands the crc_pos is 88
bits. In this case there are no extra bits which need to be added to the CRC,
but there is still a read 1 byte past the end of the crc_header stack variable.

Signed-off-by: Joshua Kessinger <jkessinger@xxxxxxxxxx>
---
 sbc/sbc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbc/sbc.c b/sbc/sbc.c
index 606f11c..7f1efaa 100644
--- a/sbc/sbc.c
+++ b/sbc/sbc.c
@@ -190,7 +190,7 @@ static uint8_t sbc_crc8(const uint8_t *data, size_t len)
 	for (i = 0; i < len / 8; i++)
 		crc = crc_table[crc ^ data[i]];
 
-	octet = data[i];
+	octet = len % 8 ? data[i] : 0;
 	for (i = 0; i < len % 8; i++) {
 		char bit = ((octet ^ crc) & 0x80) >> 7;
 
-- 
2.16.1.291.g4437f3f132-goog

--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux