If trying to parse or decode a stream with a truncated packet, the first byte past the provided data stream would be read. --- sbc/sbc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbc/sbc.c b/sbc/sbc.c index 7f1efaa..0f21481 100644 --- a/sbc/sbc.c +++ b/sbc/sbc.c @@ -499,7 +499,7 @@ static int sbc_unpack_frame_internal(const uint8_t *data, audio_sample = 0; for (bit = 0; bit < bits[ch][sb]; bit++) { - if (consumed > len * 8) + if (consumed >= len * 8) return -1; if ((data[consumed >> 3] >> (7 - (consumed & 0x7))) & 0x01) -- 2.19.1