zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix out-of-buffer read in iLBC

Browse Source 
In some cases, the decoder can read outside of an allocated array. See
the new comment in the code for more details.

BUG=chromium:568889, webrtc:5305

Review URL: https://codereview.webrtc.org/1700973002

Cr-Commit-Position: refs/heads/master@{#11637}
This commit is contained in:
henrik.lundin
2016-02-16 08:42:07 -08:00
committed by Commit bot
parent 62a5ccdb53
commit ee31f0a7d5
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c
View File

@ -18,6 +18,7 @@
#include "defines.h"
#include "constants.h"
#include "webrtc/common_audio/signal_processing/include/signal_processing_library.h"
/*----------------------------------------------------------------*
* Recreate a specific codebook vector from the augmented part.
@ -53,5 +54,15 @@ void WebRtcIlbcfix_CreateAugmentedVec(
/* copy the second noninterpolated part */
ppo = buffer - index;
WEBRTC_SPL_MEMCPY_W16(cbVec+index,ppo,(SUBL-index));
/* |tempbuff2| is declared in WebRtcIlbcfix_GetCbVec and is SUBL+5 elements
long. |buffer| points one element past the end of that vector, i.e., at
tempbuff2+SUBL+5. Since ppo=buffer-index, we cannot read any more than
|index| elements from |ppo|.
|cbVec| is declared to be SUBL elements long in WebRtcIlbcfix_CbConstruct.
Therefore, we can only write SUBL-index elements to cbVec+index.
These two conditions limit the number of elements to copy.
*/
WEBRTC_SPL_MEMCPY_W16(cbVec+index, ppo, WEBRTC_SPL_MIN(SUBL-index, index));
}