mirror of
https://github.com/asterisk/asterisk
synced 2026-08-07 10:32:13 -04:00
d4ccfd55ff
The codec2_samples() function uses floor division (160 * datalen/6) to compute expected output samples, but the decode loop condition (x < datalen) iterates with ceiling behavior when datalen is not a multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to decode one extra frame beyond what the framework bounds check budgeted for, leading to an out-of-bounds write on the output buffer. Change the loop condition to only process complete frames, matching the floor-division behavior of codec2_samples(). This also prevents an out-of-bounds read on the input side when fewer than CODEC2_FRAME_LEN bytes remain. Resolves: #GHSA-qf8j-jp7h-c5hx |
||
|---|---|---|
| .. | ||
| g722 | ||
| gsm | ||
| ilbc | ||
| lpc10 | ||
| speex | ||
| codec_a_mu.c | ||
| codec_adpcm.c | ||
| codec_alaw.c | ||
| codec_codec2.c | ||
| codec_dahdi.c | ||
| codec_g722.c | ||
| codec_g726.c | ||
| codec_gsm.c | ||
| codec_ilbc.c | ||
| codec_lpc10.c | ||
| codec_resample.c | ||
| codec_speex.c | ||
| codec_ulaw.c | ||
| codecs.xml | ||
| ex_adpcm.h | ||
| ex_alaw.h | ||
| ex_codec2.h | ||
| ex_g722.h | ||
| ex_g726.h | ||
| ex_gsm.h | ||
| ex_ilbc.h | ||
| ex_lpc10.h | ||
| ex_speex.h | ||
| ex_ulaw.h | ||
| log2comp.h | ||
| Makefile | ||