From 4009d58f3c26efa5b4e0b47c7bea9591bbf1914e Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Thu, 12 Jan 2023 12:59:10 -0500 Subject: [PATCH] MT#55283 don't crash on packet underflows If the expected buffer to hold a packet was determined incorrectly, log a warning instead of throwing an assertion. closes #1591 Change-Id: I4169378a27b27fed51e453e6d2da8014259c659e --- lib/codeclib.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/codeclib.c b/lib/codeclib.c index 9d734457f..2fc924691 100644 --- a/lib/codeclib.c +++ b/lib/codeclib.c @@ -1712,7 +1712,11 @@ int encoder_input_fifo(encoder_t *enc, AVFrame *frame, static int packetizer_passthrough(AVPacket *pkt, GString *buf, str *output, encoder_t *enc) { if (!pkt) return -1; - assert(output->len >= pkt->size); + if (output->len < pkt->size) { + ilog(LOG_WARN | LOG_FLAG_LIMIT, "Output packet size too small (%zu < %i)", + output->len, pkt->size); + return -1; + } output->len = pkt->size; memcpy(output->s, pkt->data, pkt->size); return 0; @@ -2761,7 +2765,11 @@ static int packetizer_amr(AVPacket *pkt, GString *buf, str *output, encoder_t *e assert(pkt->size >= 1); // CMR + TOC byte (already included) + optional ILL/ILP + optional CRC + payload - assert(output->len >= pkt->size + 3); + if (output->len < pkt->size + 3) { + ilog(LOG_WARN | LOG_FLAG_LIMIT, "Output AMR packet size too small (%zu < %i + 3)", + output->len, pkt->size); + return -1; + } unsigned char toc = pkt->data[0]; unsigned char ft = (toc >> 3) & 0xf;