shithub: opus

Info  •  Files  •  Log  •  Branches

Fixes packet parsing for 16-bit CPUs

Without that change, a very long (> 682 ms) illegal packet could trigger
a wrap-around in the test and be accepted as valid.

Only 16-bit architectures (e.g. TI C5x) were affected.

--- a/src/opus.c

+++ b/src/opus.c

@@ -252,7 +252,7 @@

       /* Number of frames encoded in bits 0 to 5 */

       ch = *data++;

       count = ch&0x3F;

-      if (count <= 0 || framesize*count > 5760)

+      if (count <= 0 || framesize*(opus_int32)count > 5760)

          return OPUS_INVALID_PACKET;

       len--;

       /* Padding flag is bit 6 */