commit 116c84e1b0b7d584a0f04f11de9b2bdb71b25040
author henrik.lundin <henrik.lundin@webrtc.org> Thu Aug 27 13:14:48 2015 -0700
committer Commit bot <commit-bot@chromium.org> Thu Aug 27 20:14:54 2015 +0000
tree 12c74ad6b1fe0435e1ccbf647ed22d969e2b4d58
parent 9c3efd00523a81d0f2b582799fbe67afe44139b2

NetEq: Fixing a bug that caused rtc::checked_cast to trigger

This is a bug that was introduced in
https://codereview.webrtc.org/1230503003, where the variable "int
temp_bufsize" was changed to a size_t. If the packet buffer was
flushed while inserting a packet, temp_bufsize became negative, which
was tested later in an if-statement. Now, with size_t instead, it
would just become very large, and the if-statement would never see a
negative value. The effect was that the packet size in samples could
be updated with a very large positive number, causing an overflow
which triggered rtc::checked_cast in
StatisticsCalculator::GetNetworkStatistics, line 220.

Also adding a test to reproduce the crash. Without the fix, the test
results in the above mentioned checked_cast to trigger. With the fix,
everything works fine.

BUG=chromium:525260

Review URL: https://codereview.webrtc.org/1307893004

Cr-Commit-Position: refs/heads/master@{#9802}

webrtc/modules/audio_coding/neteq/neteq_impl.cc

diff --git a/webrtc/modules/audio_coding/neteq/neteq_impl.cc b/webrtc/modules/audio_coding/neteq/neteq_impl.cc
index c9c1f86..00f854b 100644
--- a/webrtc/modules/audio_coding/neteq/neteq_impl.cc
+++ b/webrtc/modules/audio_coding/neteq/neteq_impl.cc
@@ -612,7 +612,8 @@
   }
 
   // Insert packets in buffer.
-  size_t temp_bufsize = packet_buffer_->NumPacketsInBuffer();
+  const size_t buffer_length_before_insert =
+      packet_buffer_->NumPacketsInBuffer();
   ret = packet_buffer_->InsertPacketList(
       &packet_list,
       *decoder_database_,
@@ -668,14 +669,18 @@
   delay_manager_->LastDecoderType(dec_info->codec_type);
   if (delay_manager_->last_pack_cng_or_dtmf() == 0) {
     // Calculate the total speech length carried in each packet.
-    temp_bufsize = packet_buffer_->NumPacketsInBuffer() - temp_bufsize;
-    temp_bufsize *= decoder_frame_length_;
+    const size_t buffer_length_after_insert =
+        packet_buffer_->NumPacketsInBuffer();
 
-    if ((temp_bufsize > 0) &&
-        (temp_bufsize != decision_logic_->packet_length_samples())) {
-      decision_logic_->set_packet_length_samples(temp_bufsize);
-      delay_manager_->SetPacketAudioLength(
-          static_cast<int>((1000 * temp_bufsize) / fs_hz_));
+    if (buffer_length_after_insert > buffer_length_before_insert) {
+      const size_t packet_length_samples =
+          (buffer_length_after_insert - buffer_length_before_insert) *
+          decoder_frame_length_;
+      if (packet_length_samples != decision_logic_->packet_length_samples()) {
+        decision_logic_->set_packet_length_samples(packet_length_samples);
+        delay_manager_->SetPacketAudioLength(
+            rtc::checked_cast<int>((1000 * packet_length_samples) / fs_hz_));
+      }
     }
 
     // Update statistics.