diff options
author | Joshua Kessinger <jkessinger@google.com> | 2018-02-21 11:28:00 -0800 |
---|---|---|
committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2018-09-11 11:06:17 +0300 |
commit | b3ae4260da118e53f5e6c195d40788273ff3d0b4 (patch) | |
tree | 6415b46a1d5c8ca13de93109ecfbc498741fc658 | |
parent | 24812c660036a693f8770766aa6fdea667de05d0 (diff) | |
download | sbc-b3ae4260da118e53f5e6c195d40788273ff3d0b4.tar.gz |
sbc: Fix stack overflow read in sbc_crc8.
When encoding or decoding with JOINT_STEREO and 8 subbands the crc_pos is 88
bits. In this case there are no extra bits which need to be added to the CRC,
but there is still a read 1 byte past the end of the crc_header stack variable.
-rw-r--r-- | sbc/sbc.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -190,7 +190,7 @@ static uint8_t sbc_crc8(const uint8_t *data, size_t len) for (i = 0; i < len / 8; i++) crc = crc_table[crc ^ data[i]]; - octet = data[i]; + octet = len % 8 ? data[i] : 0; for (i = 0; i < len % 8; i++) { char bit = ((octet ^ crc) & 0x80) >> 7; |