diff options
| author | Nanang Izzuddin <nanang@teluu.com> | 2010-08-05 10:41:48 +0000 |
|---|---|---|
| committer | Nanang Izzuddin <nanang@teluu.com> | 2010-08-05 10:41:48 +0000 |
| commit | 820921e537d99763c1a9d6a9b5eb7809d1a61108 (patch) | |
| tree | 17e8aa8c44abf66cec1536c286a288edfbb40728 | |
| parent | 0b04f07de50fab6b4b3c036b92fd7abef816f0b1 (diff) | |
Re #1072: fixed buffer overflow bugs introduced by r3202.
git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@3250 74dad513-b988-da41-8d7b-12977e46ad98
| -rw-r--r-- | pjmedia/src/pjmedia-codec/g722.c | 2 | ||||
| -rw-r--r-- | pjmedia/src/pjmedia-codec/g722/g722_dec.c | 5 |
2 files changed, 5 insertions, 2 deletions
diff --git a/pjmedia/src/pjmedia-codec/g722.c b/pjmedia/src/pjmedia-codec/g722.c index 842612c9..5b43a61b 100644 --- a/pjmedia/src/pjmedia-codec/g722.c +++ b/pjmedia/src/pjmedia-codec/g722.c @@ -588,7 +588,7 @@ static pj_status_t g722_codec_encode(pjmedia_codec *codec, pj_int16_t *p, *end; p = (pj_int16_t*)input->buf; - end = p + input->size; + end = p + input->size/2; while (p < end) { *p++ >>= g722_data->pcm_shift; } diff --git a/pjmedia/src/pjmedia-codec/g722/g722_dec.c b/pjmedia/src/pjmedia-codec/g722/g722_dec.c index 1579d06e..70e23109 100644 --- a/pjmedia/src/pjmedia-codec/g722/g722_dec.c +++ b/pjmedia/src/pjmedia-codec/g722/g722_dec.c @@ -504,6 +504,7 @@ PJ_DEF(pj_status_t) g722_dec_decode( g722_dec_t *dec, unsigned i; int ilowr, ylow, rlow, dlowt; int ihigh, rhigh, dhigh; + int pcm1, pcm2; pj_uint8_t *in_ = (pj_uint8_t*) in; PJ_ASSERT_RETURN(dec && in && in_size && out && nsamples, PJ_EINVAL); @@ -528,7 +529,9 @@ PJ_DEF(pj_status_t) g722_dec_decode( g722_dec_t *dec, dec->shigh = block4h (dec, dhigh) ; /* rhigh <= output high band pcm */ - rx_qmf(dec, rlow, rhigh, &out[i*2], &out[i*2+1]); + rx_qmf(dec, rlow, rhigh, &pcm1, &pcm2); + out[i*2] = (pj_int16_t)pcm1; + out[i*2+1] = (pj_int16_t)pcm2; } *nsamples = in_size << 1; |