Prevent crash in NetEQ when decoder overflow.
NetEQ can crash when decoder gives too many output samples than it can handle. A practical case this happens is when multiple opus packets are combined.
The best solution is to pass the max size to the ACM decode function and let it return a failure if the max size if too small.
BUG=4361
R=henrik.lundin@webrtc.org
Review URL: https://webrtc-codereview.appspot.com/45619004
Cr-Commit-Position: refs/heads/master@{#8730}
git-svn-id: http://webrtc.googlecode.com/svn/trunk@8730 4adac7df-926f-26a2-2b94-8c16560cd09d
diff --git a/webrtc/modules/audio_coding/neteq/neteq_impl.cc b/webrtc/modules/audio_coding/neteq/neteq_impl.cc
index 7370825..fb9656b 100644
--- a/webrtc/modules/audio_coding/neteq/neteq_impl.cc
+++ b/webrtc/modules/audio_coding/neteq/neteq_impl.cc
@@ -1267,6 +1267,7 @@
", len=" << packet->payload_length;
decode_length = decoder->DecodeRedundant(
packet->payload, packet->payload_length, fs_hz_,
+ (decoded_buffer_length_ - *decoded_length) * sizeof(int16_t),
&decoded_buffer_[*decoded_length], speech_type);
} else {
LOG(LS_VERBOSE) << "Decoding packet: ts=" << packet->header.timestamp <<
@@ -1275,8 +1276,10 @@
", ssrc=" << packet->header.ssrc <<
", len=" << packet->payload_length;
decode_length =
- decoder->Decode(packet->payload, packet->payload_length, fs_hz_,
- &decoded_buffer_[*decoded_length], speech_type);
+ decoder->Decode(
+ packet->payload, packet->payload_length, fs_hz_,
+ (decoded_buffer_length_ - *decoded_length) * sizeof(int16_t),
+ &decoded_buffer_[*decoded_length], speech_type);
}
delete[] packet->payload;
@@ -1606,8 +1609,9 @@
if (decoder) {
const uint8_t* dummy_payload = NULL;
AudioDecoder::SpeechType speech_type;
- length =
- decoder->Decode(dummy_payload, 0, fs_hz_, decoded_buffer, &speech_type);
+ length = decoder->Decode(
+ dummy_payload, 0, fs_hz_, kMaxFrameSize * sizeof(int16_t),
+ decoded_buffer, &speech_type);
}
assert(mute_factor_array_.get());
normal_->Process(decoded_buffer, length, last_mode_, mute_factor_array_.get(),