Maintain constantness of the input to iSAC-fix decoder, and prevent heap-buffer overflow.
To save memory in iSAC-fix, decoder operated directly on the recieved bitstream. However, this breaks constantness of input when decoder performed in-place big to little Endian conversion. Furthermore, for bit-streams with odd lengths, this meant writing outside the memory. That is because the last byte will be shifted to the Most Significat Byte which might be outside the allocated memory.
If we care about memory, the solution is to do a big-to-little Endian conversion everytime we read a Word16 from the bitstream.
BUG=845,chrome:379458
R=henrik.lundin@webrtc.org, tina.legrand@webrtc.org
Review URL: https://webrtc-codereview.appspot.com/15829004
git-svn-id: http://webrtc.googlecode.com/svn/trunk@6494 4adac7df-926f-26a2-2b94-8c16560cd09d
diff --git a/webrtc/modules/audio_coding/codecs/isac/fix/source/isacfix.c b/webrtc/modules/audio_coding/codecs/isac/fix/source/isacfix.c
index 688ec07..7635908 100644
--- a/webrtc/modules/audio_coding/codecs/isac/fix/source/isacfix.c
+++ b/webrtc/modules/audio_coding/codecs/isac/fix/source/isacfix.c
@@ -608,15 +608,11 @@
{
ISACFIX_SubStruct *ISAC_inst;
Bitstr_dec streamdata;
- uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
- /* Set stream pointer to point at partOfStream */
- streamdata.stream = (uint16_t *)partOfStream;
-
/* typecast pointer to real structure */
ISAC_inst = (ISACFIX_SubStruct *)ISAC_main_inst;
@@ -696,15 +692,11 @@
{
ISACFIX_SubStruct *ISAC_inst;
Bitstr_dec streamdata;
- uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
- /* Set stream pointer to point at partOfStream */
- streamdata.stream = (uint16_t *)partOfStream;
-
/* typecast pointer to real structure */
ISAC_inst = (ISACFIX_SubStruct *)ISAC_main_inst;
@@ -811,7 +803,6 @@
return -1;
}
- (ISAC_inst->ISACdec_obj.bitstr_obj).stream = (uint16_t *)encoded;
ISAC_inst->ISACdec_obj.bitstr_obj.stream_size = (len + 1) >> 1;
/* convert bitstream from int16_t to bytes */
@@ -913,7 +904,7 @@
return -1;
}
- (ISAC_inst->ISACdec_obj.bitstr_obj).stream = (uint16_t *)encoded;
+ ISAC_inst->ISACdec_obj.bitstr_obj.stream_size = (len + 1) >> 1;
/* convert bitstream from int16_t to bytes */
#ifndef WEBRTC_ARCH_BIG_ENDIAN
@@ -1288,15 +1279,11 @@
int16_t* frameLength)
{
Bitstr_dec streamdata;
- uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
- /* Set stream pointer to point at partOfStream */
- streamdata.stream = (uint16_t *)partOfStream;
-
streamdata.W_upper = 0xFFFFFFFF;
streamdata.streamval = 0;
streamdata.stream_index = 0;
@@ -1337,15 +1324,11 @@
int16_t* rateIndex)
{
Bitstr_dec streamdata;
- uint16_t partOfStream[5];
#ifndef WEBRTC_ARCH_BIG_ENDIAN
int k;
#endif
int16_t err;
- /* Set stream pointer to point at partOfStream */
- streamdata.stream = (uint16_t *)partOfStream;
-
streamdata.W_upper = 0xFFFFFFFF;
streamdata.streamval = 0;
streamdata.stream_index = 0;
diff --git a/webrtc/modules/audio_coding/codecs/isac/fix/source/structs.h b/webrtc/modules/audio_coding/codecs/isac/fix/source/structs.h
index b4d2bd8..bd20ba0 100644
--- a/webrtc/modules/audio_coding/codecs/isac/fix/source/structs.h
+++ b/webrtc/modules/audio_coding/codecs/isac/fix/source/structs.h
@@ -26,7 +26,7 @@
/* Bitstream struct for decoder */
typedef struct Bitstreamstruct_dec {
- uint16_t *stream; /* Pointer to bytestream to decode */
+ uint16_t stream[STREAM_MAXW16_60MS]; /* Array bytestream to decode */
uint32_t W_upper; /* Upper boundary of interval W */
uint32_t streamval;
uint16_t stream_index; /* Index to the current position in bytestream */
