Changeset 5731

Timestamp:

Jan 24, 2018 2:37:39 AM (7 years ago)

Author:

ming

Message:

Re #2084: Make sure the output size of opus_decode() doesn't exceed the available frame size.

File:

• pjproject/trunk/pjmedia/src/pjmedia-codec/opus.c (modified) (3 diffs)

pjproject/trunk/pjmedia/src/pjmedia-codec/opus.c

@@ -26 +26 @@
 #include <pjmedia/endpoint.h>
 #include <pj/log.h>
+#include <pj/math.h>
 
 #if defined(PJMEDIA_HAS_OPUS_CODEC) && (PJMEDIA_HAS_OPUS_CODEC!=0)
@@ -976 +977 @@
      * is missing.
      */
+    frm_size = output->size / (sizeof(opus_int16) *
+               opus_data->cfg.channel_cnt);
     if (inframe->type != PJMEDIA_FRAME_TYPE_AUDIO || fec) {
-        frm_size = opus_data->cfg.sample_rate * opus_data->ptime / 1000;
-    } else {
-        frm_size = output->size / (sizeof(opus_int16) *
-                   opus_data->cfg.channel_cnt);
+        frm_size = PJ_MIN(frm_size,
+                          opus_data->cfg.sample_rate *
+                          opus_data->ptime / 1000);
     }
     decoded_samples = opus_decode( opus_data->dec,
@@ -1051 +1053 @@
 
     inframe = &opus_data->dec_frame[opus_data->dec_frame_index];
+    frm_size = output->size / (sizeof(opus_int16) *
+               opus_data->cfg.channel_cnt);
     if (inframe->type != PJMEDIA_FRAME_TYPE_AUDIO) {
-        frm_size = opus_data->cfg.sample_rate * opus_data->ptime/1000;
-    } else {
-        frm_size = output->size / (sizeof(opus_int16) *
-                   opus_data->cfg.channel_cnt);
+        frm_size = PJ_MIN(frm_size, opus_data->cfg.sample_rate *
+                          opus_data->ptime/1000);
     }
     decoded_samples = opus_decode(opus_data->dec,