[pulseaudio-commits] [Git][pulseaudio/pulseaudio][master] bluetooth: Do not attempt decoding too short faststream packet data

[PulseAudio Marge Bot (@pulseaudio-merge-bot)]

PulseAudio Marge Bot pushed to branch master at PulseAudio / pulseaudio


Commits:
5830e030 by Igor V. Kovalenko at 2023-02-10T00:25:11+03:00
bluetooth: Do not attempt decoding too short faststream packet data

Looks like sbc_decode() would seldom access more than specified input length
bytes from input buffer if input length is less than expected frame size.

Fix potential access past allocated memory by checking if input contains
complete frame before calling sbc_decode()

Part-of: <https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/781>

- - - - -


1 changed file:

- src/modules/bluetooth/a2dp-codec-sbc.c


Changes:

=====================================
src/modules/bluetooth/a2dp-codec-sbc.c
=====================================
@@ -1331,6 +1331,11 @@ static size_t decode_buffer_faststream(void *codec_info, const uint8_t *input_bu
             continue;
         }
 
+        if (to_decode < sbc_info->frame_length) {
+            pa_log_debug("FastStream SBC input %lu is too short (expected frame length %lu)", to_decode, sbc_info->frame_length);
+            break;
+        }
+
         decoded = sbc_decode(&sbc_info->sbc,
                              p, to_decode,
                              decode_buffer, sizeof(decode_buffer),



View it on GitLab: https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/commit/5830e03036f51fc06687e61be000708b464a094e

-- 
View it on GitLab: https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/commit/5830e03036f51fc06687e61be000708b464a094e
You're receiving this email because of your account on gitlab.freedesktop.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/pulseaudio-commits/attachments/20230210/43eacb42/attachment.htm>