generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Maintain constantness of the input to iSAC-fix decoder, and prevent heap-buffer overflow.

Browse Source 
To save memory in iSAC-fix, decoder operated directly on the recieved bitstream. However, this breaks constantness of input when decoder performed in-place big to little Endian conversion. Furthermore, for bit-streams with odd lengths, this meant writing outside the memory. That is because the last byte will be shifted to the Most Significat Byte which might be outside the allocated memory.

If we care about memory, the solution is to do a big-to-little Endian conversion everytime we read a Word16 from the bitstream.

BUG=845,chrome:379458
R=henrik.lundin@webrtc.org, tina.legrand@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/15829004

git-svn-id: http://webrtc.googlecode.com/svn/trunk@6494 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
turaj@webrtc.org 2014-06-19 15:47:09 +00:00
parent 9158df2aa4
commit 8de8c9155e
2 changed files with 2 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
webrtc/modules/audio_coding/codecs/isac/fix/source/isacfix.c
View File

@ -608,15 +608,11 @@ int16_t WebRtcIsacfix_UpdateBwEstimate1(ISACFIX_MainStruct *ISAC_main_inst,
{
ISACFIX_SubStruct *ISAC_inst;
Bitstr_dec streamdata;
uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
/* Set stream pointer to point at partOfStream */
streamdata.stream = (uint16_t *)partOfStream;
/* typecast pointer to real structure */
ISAC_inst = (ISACFIX_SubStruct *)ISAC_main_inst;
@ -696,15 +692,11 @@ int16_t WebRtcIsacfix_UpdateBwEstimate(ISACFIX_MainStruct *ISAC_main_inst,
{
ISACFIX_SubStruct *ISAC_inst;
Bitstr_dec streamdata;
uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
/* Set stream pointer to point at partOfStream */
streamdata.stream = (uint16_t *)partOfStream;
/* typecast pointer to real structure */
ISAC_inst = (ISACFIX_SubStruct *)ISAC_main_inst;
@ -811,7 +803,6 @@ int16_t WebRtcIsacfix_Decode(ISACFIX_MainStruct *ISAC_main_inst,
return -1;
}
(ISAC_inst->ISACdec_obj.bitstr_obj).stream = (uint16_t *)encoded;
ISAC_inst->ISACdec_obj.bitstr_obj.stream_size = (len + 1) >> 1;
/* convert bitstream from int16_t to bytes */
@ -913,7 +904,7 @@ int16_t WebRtcIsacfix_DecodeNb(ISACFIX_MainStruct *ISAC_main_inst,
return -1;
}
(ISAC_inst->ISACdec_obj.bitstr_obj).stream = (uint16_t *)encoded;
ISAC_inst->ISACdec_obj.bitstr_obj.stream_size = (len + 1) >> 1;
/* convert bitstream from int16_t to bytes */
#ifndef WEBRTC_ARCH_BIG_ENDIAN
@ -1288,15 +1279,11 @@ int16_t WebRtcIsacfix_ReadFrameLen(const int16_t* encoded,
int16_t* frameLength)
{
Bitstr_dec streamdata;
uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
/* Set stream pointer to point at partOfStream */
streamdata.stream = (uint16_t *)partOfStream;
streamdata.W_upper = 0xFFFFFFFF;
streamdata.streamval = 0;
streamdata.stream_index = 0;
@ -1337,15 +1324,11 @@ int16_t WebRtcIsacfix_ReadBwIndex(const int16_t* encoded,
int16_t* rateIndex)
{
Bitstr_dec streamdata;
uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
/* Set stream pointer to point at partOfStream */
streamdata.stream = (uint16_t *)partOfStream;
streamdata.W_upper = 0xFFFFFFFF;
streamdata.streamval = 0;
streamdata.stream_index = 0;

2
webrtc/modules/audio_coding/codecs/isac/fix/source/structs.h
View File

@ -26,7 +26,7 @@
/* Bitstream struct for decoder */
typedef struct Bitstreamstruct_dec {
uint16_t *stream; /* Pointer to bytestream to decode */
uint16_t stream[STREAM_MAXW16_60MS]; /* Array bytestream to decode */
uint32_t W_upper; /* Upper boundary of interval W */
uint32_t streamval;
uint16_t stream_index; /* Index to the current position in bytestream */