[PATCH] sbc: Fix off-by-one error in index check when unpacking frame

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



If trying to parse or decode a stream with a truncated packet, the
first byte past the provided data stream would be read.
---
 sbc/sbc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbc/sbc.c b/sbc/sbc.c
index 7f1efaa..0f21481 100644
--- a/sbc/sbc.c
+++ b/sbc/sbc.c
@@ -499,7 +499,7 @@ static int sbc_unpack_frame_internal(const uint8_t *data,
 
 				audio_sample = 0;
 				for (bit = 0; bit < bits[ch][sb]; bit++) {
-					if (consumed > len * 8)
+					if (consumed >= len * 8)
 						return -1;
 
 					if ((data[consumed >> 3] >> (7 - (consumed & 0x7))) & 0x01)
-- 
2.19.1




[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux