summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJoshua Kessinger <jkessinger@google.com>2018-02-21 11:28:00 -0800
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2018-09-11 11:06:17 +0300
commitb3ae4260da118e53f5e6c195d40788273ff3d0b4 (patch)
tree6415b46a1d5c8ca13de93109ecfbc498741fc658
parent24812c660036a693f8770766aa6fdea667de05d0 (diff)
downloadsbc-b3ae4260da118e53f5e6c195d40788273ff3d0b4.tar.gz
sbc: Fix stack overflow read in sbc_crc8.
When encoding or decoding with JOINT_STEREO and 8 subbands the crc_pos is 88 bits. In this case there are no extra bits which need to be added to the CRC, but there is still a read 1 byte past the end of the crc_header stack variable.
-rw-r--r--sbc/sbc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sbc/sbc.c b/sbc/sbc.c
index 606f11c..7f1efaa 100644
--- a/sbc/sbc.c
+++ b/sbc/sbc.c
@@ -190,7 +190,7 @@ static uint8_t sbc_crc8(const uint8_t *data, size_t len)
for (i = 0; i < len / 8; i++)
crc = crc_table[crc ^ data[i]];
- octet = data[i];
+ octet = len % 8 ? data[i] : 0;
for (i = 0; i < len % 8; i++) {
char bit = ((octet ^ crc) & 0x80) >> 7;