Prevent crash in NetEQ when decoder overflow.

NetEQ can crash when decoder gives too many output samples than it can handle. A practical case this happens is when multiple opus packets are combined.

The best solution is to pass the max size to the ACM decode function and let it return a failure if the max size if too small.

BUG=4361
R=henrik.lundin@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/45619004

Cr-Commit-Position: refs/heads/master@{#8730}
git-svn-id: http://webrtc.googlecode.com/svn/trunk@8730 4adac7df-926f-26a2-2b94-8c16560cd09d
diff --git a/webrtc/modules/audio_coding/neteq/neteq_impl.cc b/webrtc/modules/audio_coding/neteq/neteq_impl.cc
index 7370825..fb9656b 100644
--- a/webrtc/modules/audio_coding/neteq/neteq_impl.cc
+++ b/webrtc/modules/audio_coding/neteq/neteq_impl.cc
@@ -1267,6 +1267,7 @@
           ", len=" << packet->payload_length;
       decode_length = decoder->DecodeRedundant(
           packet->payload, packet->payload_length, fs_hz_,
+          (decoded_buffer_length_ - *decoded_length) * sizeof(int16_t),
           &decoded_buffer_[*decoded_length], speech_type);
     } else {
       LOG(LS_VERBOSE) << "Decoding packet: ts=" << packet->header.timestamp <<
@@ -1275,8 +1276,10 @@
           ", ssrc=" << packet->header.ssrc <<
           ", len=" << packet->payload_length;
       decode_length =
-          decoder->Decode(packet->payload, packet->payload_length, fs_hz_,
-                          &decoded_buffer_[*decoded_length], speech_type);
+          decoder->Decode(
+              packet->payload, packet->payload_length, fs_hz_,
+              (decoded_buffer_length_ - *decoded_length) * sizeof(int16_t),
+              &decoded_buffer_[*decoded_length], speech_type);
     }
 
     delete[] packet->payload;
@@ -1606,8 +1609,9 @@
   if (decoder) {
     const uint8_t* dummy_payload = NULL;
     AudioDecoder::SpeechType speech_type;
-    length =
-        decoder->Decode(dummy_payload, 0, fs_hz_, decoded_buffer, &speech_type);
+    length = decoder->Decode(
+        dummy_payload, 0, fs_hz_, kMaxFrameSize * sizeof(int16_t),
+        decoded_buffer, &speech_type);
   }
   assert(mute_factor_array_.get());
   normal_->Process(decoded_buffer, length, last_mode_, mute_factor_array_.get(),