Merge 97214 - Heap buffer overflow in Webaudio FFTFrame::doFFT

Source/WebCore/platform/audio/HRTFKernel.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 33 matching lines @@
 // Takes the input AudioChannel as an input impulse response and calculates the average group delay.
 // This represents the initial delay before the most energetic part of the impulse response.
 // The sample-frame delay is removed from the impulseP impulse response, and this value  is returned.
 // the length of the passed in AudioChannel must be a power of 2.
 static double extractAverageGroupDelay(AudioChannel* channel, size_t analysisFFTSize)
 {
     ASSERT(channel);
         
     float* impulseP = channel->data();
     
-    ASSERT(channel->length() >= analysisFFTSize);
+    bool isSizeGood = channel->length() >= analysisFFTSize;
+    ASSERT(isSizeGood);
+    if (!isSizeGood)
+        return 0;
     
     // Check for power-of-2.
     ASSERT(1UL << static_cast<unsigned>(log2(analysisFFTSize)) == analysisFFTSize);
 
     FFTFrame estimationFrame(analysisFFTSize);
     estimationFrame.doFFT(impulseP);
 
     double frameDelay = estimationFrame.extractAverageGroupDelay();
     estimationFrame.doInverseFFT(impulseP);
 
@@ skipping 68 matching lines @@
     
     double frameDelay = (1.0 - x) * kernel1->frameDelay() + x * kernel2->frameDelay();
     
     OwnPtr<FFTFrame> interpolatedFrame = FFTFrame::createInterpolatedFrame(*kernel1->fftFrame(), *kernel2->fftFrame(), x);
     return HRTFKernel::create(interpolatedFrame.release(), frameDelay, sampleRate1);
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)