[PATCH] sbc: Fix off-by-one error in index check when unpacking frame

[PATCH] sbc: Fix off-by-one error in index check when unpacking frame

[Per Waagø]

If trying to parse or decode a stream with a truncated packet, the
first byte past the provided data stream would be read.
---
 sbc/sbc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbc/sbc.c b/sbc/sbc.c
index 7f1efaa..0f21481 100644
--- a/sbc/sbc.c
+++ b/sbc/sbc.c
@@ -499,7 +499,7 @@ static int sbc_unpack_frame_internal(const uint8_t *data,
 
 				audio_sample = 0;
 				for (bit = 0; bit < bits[ch][sb]; bit++) {
-					if (consumed > len * 8)
+					if (consumed >= len * 8)
 						return -1;
 
 					if ((data[consumed >> 3] >> (7 - (consumed & 0x7))) & 0x01)
-- 
2.19.1

Re: [PATCH] sbc: Fix off-by-one error in index check when unpacking frame

[Per Waagø]

The problem can be demonstrated with the program below. Valgrind will 
fail when running this program for values of short_packet_size from 12 
through 113.
--
#include <sbc/sbc.h>

#include <stdlib.h>
#include <string.h>

static void encode_and_truncate_frame(uint8_t * dest, size_t dest_size)
{
     sbc_t enc;
     sbc_init(&enc, 0);
     enc.frequency = SBC_FREQ_48000;
     enc.blocks = SBC_BLK_16;
     enc.subbands = SBC_SB_8;
     enc.mode = SBC_MODE_STEREO;
     enc.allocation = SBC_AM_LOUDNESS;
     enc.bitpool = 51;
     enc.endian = SBC_LE;

     const size_t input_frame_size = sbc_get_codesize(&enc);
     const size_t output_frame_size = sbc_get_frame_length(&enc);
     uint8_t * input_frame = calloc(1, input_frame_size);
     uint8_t * output_frame = calloc(1, input_frame_size);

     ssize_t produced;
     sbc_encode(&enc, input_frame, input_frame_size,
         output_frame, output_frame_size,
         &produced);

     memcpy(dest, output_frame, dest_size);

     free(input_frame);
     free(output_frame);
     sbc_finish(&enc);
}

int main(int argc, char * argv[])
{
     const size_t short_packet_size = 12;
     uint8_t * short_packet = malloc(short_packet_size);
     encode_and_truncate_frame(short_packet, short_packet_size);

     sbc_t dec;
     sbc_init(&dec, 0);

     sbc_parse(&dec, short_packet, short_packet_size);

     sbc_finish(&dec);
     free(short_packet);
     return 0;
}