Index: src/opus_multistream_decoder.c |
diff --git a/src/opus_multistream_decoder.c b/src/opus_multistream_decoder.c |
index f3d2311e450b5c4131c0d00a0c2604a14bbbd1e0..a05fa1e765bbba64723ee504e24db72b62f62f4d 100644 |
--- a/src/opus_multistream_decoder.c |
+++ b/src/opus_multistream_decoder.c |
@@ -152,6 +152,35 @@ typedef void (*opus_copy_channel_out_func)( |
int frame_size |
); |
+static int opus_multistream_packet_validate(const unsigned char *data, |
+ opus_int32 len, int nb_streams, opus_int32 Fs) |
+{ |
+ int s; |
+ int count; |
+ unsigned char toc; |
+ opus_int16 size[48]; |
+ int samples=0; |
+ opus_int32 packet_offset; |
+ |
+ for (s=0;s<nb_streams;s++) |
+ { |
+ int tmp_samples; |
+ if (len<=0) |
+ return OPUS_INVALID_PACKET; |
+ count = opus_packet_parse_impl(data, len, s!=nb_streams-1, &toc, NULL, |
+ size, NULL, &packet_offset); |
+ if (count<0) |
+ return count; |
+ tmp_samples = opus_packet_get_nb_samples(data, packet_offset, Fs); |
+ if (s!=0 && samples != tmp_samples) |
+ return OPUS_INVALID_PACKET; |
+ samples = tmp_samples; |
+ data += packet_offset; |
+ len -= packet_offset; |
+ } |
+ return samples; |
+} |
+ |
static int opus_multistream_decode_native( |
OpusMSDecoder *st, |
const unsigned char *data, |
@@ -183,9 +212,28 @@ static int opus_multistream_decode_native( |
if (len==0) |
do_plc = 1; |
if (len < 0) |
+ { |
+ RESTORE_STACK; |
return OPUS_BAD_ARG; |
+ } |
if (!do_plc && len < 2*st->layout.nb_streams-1) |
+ { |
+ RESTORE_STACK; |
return OPUS_INVALID_PACKET; |
+ } |
+ if (!do_plc) |
+ { |
+ int ret = opus_multistream_packet_validate(data, len, st->layout.nb_streams, Fs); |
+ if (ret < 0) |
+ { |
+ RESTORE_STACK; |
+ return ret; |
+ } else if (ret > frame_size) |
+ { |
+ RESTORE_STACK; |
+ return OPUS_BUFFER_TOO_SMALL; |
+ } |
+ } |
for (s=0;s<st->layout.nb_streams;s++) |
{ |
OpusDecoder *dec; |
@@ -197,22 +245,12 @@ static int opus_multistream_decode_native( |
if (!do_plc && len<=0) |
{ |
RESTORE_STACK; |
- return OPUS_INVALID_PACKET; |
+ return OPUS_INTERNAL_ERROR; |
} |
packet_offset = 0; |
ret = opus_decode_native(dec, data, len, buf, frame_size, decode_fec, s!=st->layout.nb_streams-1, &packet_offset, soft_clip); |
data += packet_offset; |
len -= packet_offset; |
- if (ret > frame_size) |
- { |
- RESTORE_STACK; |
- return OPUS_BUFFER_TOO_SMALL; |
- } |
- if (s>0 && ret != frame_size) |
- { |
- RESTORE_STACK; |
- return OPUS_INVALID_PACKET; |
- } |
if (ret <= 0) |
{ |
RESTORE_STACK; |