Control: tags -1 + patch
Hi,
A fix for CVE-2026-16473 was posted to linux-bluetooth on 2026-07-29 by
Oğuzhan Akkaya, but it hasn't been merged or reviewed. Upstream sbc.git
still ends at b3deb8a ("Release 2.2", 2026-02-09). The patch was sent as an
attachment to an HTML mail, which may be why it got no review:
https://www.google.com/url?q=https://lore.kernel.org/linux-bluetooth/[email protected]/&source=gmail&ust=1793764588820000&sa=E
Root cause: in sbc_unpack_frame_internal() (sbc/sbc.c), the per-sample bit
reader checks `if (consumed > len * 8)` before reading
data[consumed >> 3]. When consumed == len * 8, the check passes and
data[len] is read, one byte past the input. The other bounds checks in
the function (joint-stereo bits and scale factors) use
`len * 8 < consumed + n` and are correct.
The patch (author Oğuzhan Akkaya, Signed-off-by in the original) changes
the comparison to >=:
--- a/sbc/sbc.c
+++ b/sbc/sbc.c
@@ -483,7 +483,7 @@ static int sbc_unpack_frame_internal(const uint8_t
*data,
audio_sample = 0;
for (bit = 0; bit < bits[ch][sb]; bit++) {
- if (consumed > len * 8)
+ if (consumed >= len * 8)
return -1;
if ((data[consumed >> 3] >> (7 - (consumed & 0x7))) & 0x01)
I verified it independently against upstream git b3deb8a with my own
harness, built with -fsanitize=address:
- Before: sbc_decode() on the 14-byte frame from the report
(9c bd b0 36 7d f2 f2 f2 f2 f2 f2 f2 f2 f2), copied into an exactly
sized heap buffer, gives "AddressSanitizer: heap-buffer-overflow, READ of
size 1" in sbc_unpack_frame_internal sbc/sbc.c:489 <- sbc_unpack_frame
:578 <- sbc_decode :1225, "located 0 bytes after 14-byte region".
- After: sbc_decode() returns -1 and ASan is clean.
- Regression check: I encoded pseudo-random PCM over every combination of
frequency, block count, channel mode, subbands, allocation method and
bitpool (step 7 from 2 to 250), plus mSBC. That is 21252 frames. I
decoded each frame from an exactly sized heap buffer (the boundary case
the patch touches). Unpatched and patched builds both report 0 decode
failures and produce the same decoded-PCM checksum
(c2037ac4477137d5), with no ASan errors.
The patch applies cleanly to the 2.1-1 source (patch -p1 --dry-run
against sbc/sbc.c from
https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793764588820000&sa=E
).
Thanks!
