<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html lang="en" style='--code-editor-font: var(--default-mono-font, "Menlo"), DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'> <head> <meta content="text/html; charset=US-ASCII" http-equiv="Content-Type"> <title> GitLab </title> <style data-premailer="ignore" type="text/css"> a { color: #1068bf; } </style> <style>img { max-width: 100%; height: auto; } body { font-size: 0.875rem; } body { -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; } body { font-family: var(--default-regular-font, -apple-system),BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit; } </style> </head> <body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: var(--default-regular-font, -apple-system),BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'> <div class="content"> <h3 style="margin-top: 20px; margin-bottom: 10px;"> PulseAudio Marge Bot pushed to branch master at <a href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio">PulseAudio / pulseaudio</a> </h3> <h4 style="margin-top: 10px; margin-bottom: 10px;"> Commits: </h4> <ul> <li> <a href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/commit/5830e03036f51fc06687e61be000708b464a094e">5830e030</a> <div> by Igor V. Kovalenko at 2023-02-10T00:25:11+03:00 </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>bluetooth: Do not attempt decoding too short faststream packet data Looks like sbc_decode() would seldom access more than specified input length bytes from input buffer if input length is less than expected frame size. Fix potential access past allocated memory by checking if input contains complete frame before calling sbc_decode() Part-of: <https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/781> </pre> </li> </ul> <h4 style="margin-top: 10px; margin-bottom: 10px;"> 1 changed file: </h4> <ul> <li class="file-stats"> <a href="#77b6c205454537e9383387f41ee4e14a047a0d46"> src/modules/bluetooth/a2dp-codec-sbc.c </a> </li> </ul> <h4 style="margin-top: 10px; margin-bottom: 10px;"> Changes: </h4> <li id="77b6c205454537e9383387f41ee4e14a047a0d46"> <a href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/commit/5830e03036f51fc06687e61be000708b464a094e#77b6c205454537e9383387f41ee4e14a047a0d46">src/modules/bluetooth/a2dp-codec-sbc.c</a> <hr style="overflow: hidden; border: 1px solid #e1e1e1;"> <table class="code white" style="border-spacing: 0; border-collapse: collapse; width: auto; font-family: monospace; font-size: 90%;" bgcolor="#fff" width="100%" cellpadding="0" cellspacing="0"> <tr class="line_holder match" style="line-height: 1.6;"> <td class="diff-line-num unfold js-unfold old_line" data-linenumber="1331" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd">...</td> <td class="diff-line-num unfold js-unfold new_line" data-linenumber="1331" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd">...</td> <td class="line_content match" style="color: rgba(31,30,36,0.24); padding: inherit;" bgcolor="#fbfafd">@@ -1331,6 +1331,11 @@ static size_t decode_buffer_faststream(void *codec_info, const uint8_t *input_bu</td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="1331" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1331 </td> <td class="new_line diff-line-num" data-linenumber="1331" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1331 </td> <td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'> continue; </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="1332" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1332 </td> <td class="new_line diff-line-num" data-linenumber="1332" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1332 </td> <td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'> } </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="1333" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1333 </td> <td class="new_line diff-line-num" data-linenumber="1333" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1333 </td> <td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'> </pre></td> </tr> <tr class="line_holder new" style="line-height: 1.6;"> <td class="old_line diff-line-num new" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> </td> <td class="new_line diff-line-num new" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> 1334 </td> <td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+ if (to_decode < sbc_info->frame_length) { </pre></td> </tr> <tr class="line_holder new" style="line-height: 1.6;"> <td class="old_line diff-line-num new" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> </td> <td class="new_line diff-line-num new" data-linenumber="1335" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> 1335 </td> <td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+ pa_log_debug("FastStream SBC input %lu is too short (expected frame length %lu)", to_decode, sbc_info->frame_length); </pre></td> </tr> <tr class="line_holder new" style="line-height: 1.6;"> <td class="old_line diff-line-num new" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> </td> <td class="new_line diff-line-num new" data-linenumber="1336" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> 1336 </td> <td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+ break; </pre></td> </tr> <tr class="line_holder new" style="line-height: 1.6;"> <td class="old_line diff-line-num new" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> </td> <td class="new_line diff-line-num new" data-linenumber="1337" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> 1337 </td> <td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+ } </pre></td> </tr> <tr class="line_holder new" style="line-height: 1.6;"> <td class="old_line diff-line-num new" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> </td> <td class="new_line diff-line-num new" data-linenumber="1338" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6"> 1338 </td> <td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+ </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="1334" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1334 </td> <td class="new_line diff-line-num" data-linenumber="1339" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1339 </td> <td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'> decoded = sbc_decode(&sbc_info->sbc, </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="1335" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1335 </td> <td class="new_line diff-line-num" data-linenumber="1340" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1340 </td> <td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'> p, to_decode, </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="1336" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1336 </td> <td class="new_line diff-line-num" data-linenumber="1341" style="width: 35px; color: rgba(31,30,36,0.24); border-right-width: 1px; border-right-color: #ececef; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fbfafd"> 1341 </td> <td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'> decode_buffer, sizeof(decode_buffer), </pre></td> </tr> </table> </li> </div> <div class="footer" style="margin-top: 10px;"> — <a href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/commit/5830e03036f51fc06687e61be000708b464a094e">View it on GitLab</a>. You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.freedesktop.org">gitlab.freedesktop.org</a>. <a href="https://gitlab.freedesktop.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.freedesktop.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a> <script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/commit/5830e03036f51fc06687e61be000708b464a094e"}}</script> </div> </body> </html>