zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NetEq: Fixing a bug that caused rtc::checked_cast to trigger

Browse Source 
This is a bug that was introduced in
https://codereview.webrtc.org/1230503003, where the variable "int
temp_bufsize" was changed to a size_t. If the packet buffer was
flushed while inserting a packet, temp_bufsize became negative, which
was tested later in an if-statement. Now, with size_t instead, it
would just become very large, and the if-statement would never see a
negative value. The effect was that the packet size in samples could
be updated with a very large positive number, causing an overflow
which triggered rtc::checked_cast in
StatisticsCalculator::GetNetworkStatistics, line 220.

Also adding a test to reproduce the crash. Without the fix, the test
results in the above mentioned checked_cast to trigger. With the fix,
everything works fine.

BUG=chromium:525260

Review URL: https://codereview.webrtc.org/1307893004

Cr-Commit-Position: refs/heads/master@{#9802}
This commit is contained in:
henrik.lundin
2015-08-27 13:14:48 -07:00
committed by Commit bot
parent 9c3efd0052
commit 116c84e1b0
2 changed files with 53 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
webrtc/modules/audio_coding/neteq/neteq_impl.cc
View File

@ -612,7 +612,8 @@ int NetEqImpl::InsertPacketInternal(const WebRtcRTPHeader& rtp_header,
}
// Insert packets in buffer.
size_t temp_bufsize = packet_buffer_->NumPacketsInBuffer();
const size_t buffer_length_before_insert =
packet_buffer_->NumPacketsInBuffer();
ret = packet_buffer_->InsertPacketList(
&packet_list,
*decoder_database_,
@ -668,14 +669,18 @@ int NetEqImpl::InsertPacketInternal(const WebRtcRTPHeader& rtp_header,
delay_manager_->LastDecoderType(dec_info->codec_type);
if (delay_manager_->last_pack_cng_or_dtmf() == 0) {
// Calculate the total speech length carried in each packet.
temp_bufsize = packet_buffer_->NumPacketsInBuffer() - temp_bufsize;
temp_bufsize *= decoder_frame_length_;
const size_t buffer_length_after_insert =
packet_buffer_->NumPacketsInBuffer();
if ((temp_bufsize > 0) &&
(temp_bufsize != decision_logic_->packet_length_samples())) {
decision_logic_->set_packet_length_samples(temp_bufsize);
delay_manager_->SetPacketAudioLength(
static_cast<int>((1000 * temp_bufsize) / fs_hz_));
if (buffer_length_after_insert > buffer_length_before_insert) {
const size_t packet_length_samples =
(buffer_length_after_insert - buffer_length_before_insert) *
decoder_frame_length_;
if (packet_length_samples != decision_logic_->packet_length_samples()) {
decision_logic_->set_packet_length_samples(packet_length_samples);
delay_manager_->SetPacketAudioLength(
rtc::checked_cast<int>((1000 * packet_length_samples) / fs_hz_));
}
}
// Update statistics.