zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix out-of-bounds memory access due to large number of audio channels.

Browse Source 
The number of audio channels can be configured in SDP, and can thus be
set to arbitrary values by an attacker. This CL fixes an out-of-bounds
memory access that could occur when the number of channels is set to a
large number.

Bug: chromium:1265806
Change-Id: Ic88ff6d85b978b8eb99bf03cc52457a4552e8c24
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/237808
Reviewed-by: Jakob Ivarsson <jakobi@webrtc.org>
Commit-Queue: Ivo Creusen <ivoc@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#35354}
This commit is contained in:
Ivo Creusen
2021-11-16 11:18:10 +00:00
committed by WebRTC LUCI CQ
parent 13d163654a
commit 4cbfe4192c
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
modules/audio_coding/neteq/neteq_impl.cc
View File

@ -798,7 +798,19 @@ int NetEqImpl::GetAudioInternal(AudioFrame* audio_frame,
RTC_DCHECK(audio_frame->muted()); // Reset() should mute the frame.
playout_timestamp_ += static_cast<uint32_t>(output_size_samples_);
audio_frame->sample_rate_hz_ = fs_hz_;
audio_frame->samples_per_channel_ = output_size_samples_;
// Make sure the total number of samples fits in the AudioFrame.
size_t num_output_samples_per_channel = output_size_samples_;
size_t num_output_samples = output_size_samples_ * sync_buffer_->Channels();
if (num_output_samples > AudioFrame::kMaxDataSizeSamples) {
RTC_LOG(LS_WARNING) << "Output array is too short. "
<< AudioFrame::kMaxDataSizeSamples << " < "
<< output_size_samples_ << " * "
<< sync_buffer_->Channels();
num_output_samples = AudioFrame::kMaxDataSizeSamples;
num_output_samples_per_channel =
AudioFrame::kMaxDataSizeSamples / sync_buffer_->Channels();
}
audio_frame->samples_per_channel_ = num_output_samples_per_channel;
audio_frame->timestamp_ =
first_packet_
? 0