From 5830e03036f51fc06687e61be000708b464a094e Mon Sep 17 00:00:00 2001 From: "Igor V. Kovalenko" Date: Thu, 9 Feb 2023 23:15:55 +0300 Subject: bluetooth: Do not attempt decoding too short faststream packet data Looks like sbc_decode() would seldom access more than specified input length bytes from input buffer if input length is less than expected frame size. Fix potential access past allocated memory by checking if input contains complete frame before calling sbc_decode() Part-of: --- src/modules/bluetooth/a2dp-codec-sbc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/modules/bluetooth/a2dp-codec-sbc.c b/src/modules/bluetooth/a2dp-codec-sbc.c index 5476697f8..1306c79f2 100644 --- a/src/modules/bluetooth/a2dp-codec-sbc.c +++ b/src/modules/bluetooth/a2dp-codec-sbc.c @@ -1331,6 +1331,11 @@ static size_t decode_buffer_faststream(void *codec_info, const uint8_t *input_bu continue; } + if (to_decode < sbc_info->frame_length) { + pa_log_debug("FastStream SBC input %lu is too short (expected frame length %lu)", to_decode, sbc_info->frame_length); + break; + } + decoded = sbc_decode(&sbc_info->sbc, p, to_decode, decode_buffer, sizeof(decode_buffer), -- cgit v1.2.1