admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a check in the BlockBuffer of AEC2 to guard for buffer overflows.

Browse Source 
Ensure that the ring buffer does not return a pointer into the buffer if
no data is available to read.

The ring buffer fix is not directly applicable to issue webrtc:7845, but may cause related memory errors.

BUG=webrtc:7845

Review-Url: https://codereview.webrtc.org/2971313002
Cr-Commit-Position: refs/heads/master@{#18940}
This commit is contained in:
saza 2017-07-10 01:01:09 -07:00 committed by Commit Bot
parent 3ffa72d0f0
commit 5de068082b
3 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
webrtc/common_audio/ring_buffer.c
View File

@ -118,7 +118,6 @@ size_t WebRtc_ReadBuffer(RingBuffer* self,
&buf_ptr_bytes_1,
&buf_ptr_2,
&buf_ptr_bytes_2);
if (buf_ptr_bytes_2 > 0) {
// We have a wrap around when reading the buffer. Copy the buffer data to
// |data| and point to it.
@ -131,7 +130,7 @@ size_t WebRtc_ReadBuffer(RingBuffer* self,
}
if (data_ptr) {
// |buf_ptr_1| == |data| in the case of a wrap.
*data_ptr = buf_ptr_1;
*data_ptr = read_count == 0 ? NULL : buf_ptr_1;
}
// Update read position

13
webrtc/common_audio/ring_buffer.h
View File

@ -36,12 +36,13 @@ RingBuffer* WebRtc_CreateBuffer(size_t element_count, size_t element_size);
void WebRtc_InitBuffer(RingBuffer* handle);
void WebRtc_FreeBuffer(void* handle);
// Reads data from the buffer. The |data_ptr| will point to the address where
// it is located. If all |element_count| data are feasible to read without
// buffer wrap around |data_ptr| will point to the location in the buffer.
// Otherwise, the data will be copied to |data| (memory allocation done by the
// user) and |data_ptr| points to the address of |data|. |data_ptr| is only
// guaranteed to be valid until the next call to WebRtc_WriteBuffer().
// Reads data from the buffer. Returns the number of elements that were read.
// The |data_ptr| will point to the address where the read data is located.
// If no data can be read, |data_ptr| is set to |NULL|. If all data can be read
// without buffer wrap around then |data_ptr| will point to the location in the
// buffer. Otherwise, the data will be copied to |data| (memory allocation done
// by the user) and |data_ptr| points to the address of |data|. |data_ptr| is
// only guaranteed to be valid until the next call to WebRtc_WriteBuffer().
//
// To force a copying to |data|, pass a null |data_ptr|.
//

11
webrtc/modules/audio_processing/aec/aec_core.cc
View File

@ -206,15 +206,18 @@ void BlockBuffer::ExtractExtendedBlock(float extended_block[PART_LEN2]) {
// Extract the previous block.
WebRtc_MoveReadPtr(buffer_, -1);
WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
&extended_block[0], 1);
size_t read_elements = WebRtc_ReadBuffer(
buffer_, reinterpret_cast<void**>(&block_ptr), &extended_block[0], 1);
RTC_CHECK_EQ(read_elements, 1);
if (block_ptr != &extended_block[0]) {
memcpy(&extended_block[0], block_ptr, PART_LEN * sizeof(float));
}
// Extract the current block.
WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
&extended_block[PART_LEN], 1);
read_elements =
WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
&extended_block[PART_LEN], 1);
RTC_CHECK_EQ(read_elements, 1);
if (block_ptr != &extended_block[PART_LEN]) {
memcpy(&extended_block[PART_LEN], block_ptr, PART_LEN * sizeof(float));
}