zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent crash in NetEQ when decoder overflow.

Browse Source 
NetEQ can crash when decoder gives too many output samples than it can handle. A practical case this happens is when multiple opus packets are combined.

The best solution is to pass the max size to the ACM decode function and let it return a failure if the max size if too small.

BUG=4361
R=henrik.lundin@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/45619004

Cr-Commit-Position: refs/heads/master@{#8730}
git-svn-id: http://webrtc.googlecode.com/svn/trunk@8730 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
minyue@webrtc.org
2015-03-16 12:30:37 +00:00
parent 4b89aa03bb
commit 7f7d7e3427
19 changed files with 453 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
webrtc/modules/audio_coding/neteq/neteq_impl.cc
View File

@ -1267,6 +1267,7 @@ int NetEqImpl::DecodeLoop(PacketList* packet_list, Operations* operation,
", len=" << packet->payload_length;
decode_length = decoder->DecodeRedundant(
packet->payload, packet->payload_length, fs_hz_,
(decoded_buffer_length_ - *decoded_length) * sizeof(int16_t),
&decoded_buffer_[*decoded_length], speech_type);
} else {
LOG(LS_VERBOSE) << "Decoding packet: ts=" << packet->header.timestamp <<
@ -1275,8 +1276,10 @@ int NetEqImpl::DecodeLoop(PacketList* packet_list, Operations* operation,
", ssrc=" << packet->header.ssrc <<
", len=" << packet->payload_length;
decode_length =
decoder->Decode(packet->payload, packet->payload_length, fs_hz_,
&decoded_buffer_[*decoded_length], speech_type);
decoder->Decode(
packet->payload, packet->payload_length, fs_hz_,
(decoded_buffer_length_ - *decoded_length) * sizeof(int16_t),
&decoded_buffer_[*decoded_length], speech_type);
}
delete[] packet->payload;
@ -1606,8 +1609,9 @@ void NetEqImpl::DoCodecInternalCng() {
if (decoder) {
const uint8_t* dummy_payload = NULL;
AudioDecoder::SpeechType speech_type;
length =
decoder->Decode(dummy_payload, 0, fs_hz_, decoded_buffer, &speech_type);
length = decoder->Decode(
dummy_payload, 0, fs_hz_, kMaxFrameSize * sizeof(int16_t),
decoded_buffer, &speech_type);
}
assert(mute_factor_array_.get());
normal_->Process(decoded_buffer, length, last_mode_, mute_factor_array_.get(),