shithub: opus

Info  •  Files  •  Log  •  Branches

More error handling

--- a/src/opus_decoder.c

+++ b/src/opus_decoder.c

@@ -340,18 +340,18 @@

 {

 	int i, bytes, nb_samples;

 	int count;

+	unsigned char ch, toc;

 	/* 48 x 2.5 ms = 120 ms */

 	short size[48];

 	if (len<1)

 		return CELT_BAD_ARG;

-	count = opus_packet_get_nb_frames(data, len);

 	st->mode = opus_packet_get_mode(data);

 	st->bandwidth = opus_packet_get_bandwidth(data);

 	st->frame_size = opus_packet_get_samples_per_frame(data, st->Fs);

 	st->stream_channels = opus_packet_get_nb_channels(data);

-	data++;

+	toc = *data++;

 	len--;

-	switch (data[-1]&0x3)

+	switch (toc&0x3)

 	{

 	/* One frame */

 	case 0:

@@ -380,11 +380,13 @@

 		if (len<1)

 			return OPUS_CORRUPTED_DATA;

 		/* Number of frames encoded in bits 0 to 5 */

-		count = data[0]&0x3F;

-		data++;

+		ch = *data++;

+		count = ch&0x3F;

+		if (st->frame_size*count*25 > 3*st->Fs)

+		    return OPUS_CORRUPTED_DATA;

 		len--;

 		/* Bit 7 is VBR flag (bit 6 is ignored) */

-		if (data[0]&0x80)

+		if (ch&0x80)

 		{

 			/* VBR case */

 			int last_size=len;