提交 0e0f299c authored 作者: Michael Jerris's avatar Michael Jerris

bounds checks to avoid buffer overflow. Found by Klockwork (www.klocwork.com)

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@8486 d0543943-73ff-0310-b7d9-9358b9ac24b2
上级 151af23a
...@@ -115,7 +115,7 @@ static switch_status_t switch_ilbc_encode(switch_codec_t *codec, ...@@ -115,7 +115,7 @@ static switch_status_t switch_ilbc_encode(switch_codec_t *codec,
float buf[240]; float buf[240];
for (x = 0; x < loops && new_len < *encoded_data_len; x++) { for (x = 0; x < loops && new_len < *encoded_data_len; x++) {
for (y = 0; y < context->dbytes / sizeof(short); y++) { for (y = 0; y < context->dbytes / sizeof(short) && y < 240; y++) {
buf[y] = ddp[y]; buf[y] = ddp[y];
} }
iLBC_encode(edp, buf, &context->encoder); iLBC_encode(edp, buf, &context->encoder);
...@@ -157,7 +157,7 @@ static switch_status_t switch_ilbc_decode(switch_codec_t *codec, ...@@ -157,7 +157,7 @@ static switch_status_t switch_ilbc_decode(switch_codec_t *codec,
for (x = 0; x < loops && new_len < *decoded_data_len; x++) { for (x = 0; x < loops && new_len < *decoded_data_len; x++) {
iLBC_decode(buf, edp, &context->decoder, 1); iLBC_decode(buf, edp, &context->decoder, 1);
for (y = 0; y < context->dbytes / sizeof(short); y++) { for (y = 0; y < context->dbytes / sizeof(short) && y < 240; y++) {
ddp[y] = (short) buf[y]; ddp[y] = (short) buf[y];
} }
ddp += context->dbytes / sizeof(short); ddp += context->dbytes / sizeof(short);
......
Markdown 格式
0%
您添加了 0 到此讨论。请谨慎行事。
请先完成此评论的编辑!
注册 或者 后发表评论