admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set memory to all-zero floats in ExtractExtendedBlock in AEC2 if buffer is empty.

Browse Source 
This avoids a memcopy call which may corrupt audio handling and, in rare cases, crash WebRTC with a buffer over-read.

BUG=webrtc:7845

Review-Url: https://codereview.webrtc.org/2980723002
Cr-Commit-Position: refs/heads/master@{#18984}
This commit is contained in:
saza 2017-07-12 01:43:14 -07:00 committed by Commit Bot
parent 10b0d03673
commit f91b0b49f9
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
webrtc/modules/audio_processing/aec/aec_core.cc
View File

@ -206,16 +206,21 @@ void BlockBuffer::ExtractExtendedBlock(float extended_block[PART_LEN2]) {
// Extract the previous block.
WebRtc_MoveReadPtr(buffer_, -1);
WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
&extended_block[0], 1);
if (block_ptr != &extended_block[0]) {
size_t read_elements = WebRtc_ReadBuffer(
buffer_, reinterpret_cast<void**>(&block_ptr), &extended_block[0], 1);
if (read_elements == 0u) {
std::fill_n(&extended_block[0], PART_LEN, 0.0f);
} else if (block_ptr != &extended_block[0]) {
memcpy(&extended_block[0], block_ptr, PART_LEN * sizeof(float));
}
// Extract the current block.
WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
&extended_block[PART_LEN], 1);
if (block_ptr != &extended_block[PART_LEN]) {
read_elements =
WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
&extended_block[PART_LEN], 1);
if (read_elements == 0u) {
std::fill_n(&extended_block[PART_LEN], PART_LEN, 0.0f);
} else if (block_ptr != &extended_block[PART_LEN]) {
memcpy(&extended_block[PART_LEN], block_ptr, PART_LEN * sizeof(float));
}
}