pespin has uploaded this change for review.
amr: osmo_amr_bwe_to_oa(): Modify loop to allow osmo_amr_bytes()=0 (NO_DATA)
oa_payload_len can be 2 if osmo_amr_bytes() returns 0 (it will return 0
when FT NO_DATA is supported). In tha case, the loop condition
(oa_payload_len - 3) (signed) is compared against unsigned i which ends
up accessing i=256.
Change-Id: I1e513f493d7883a03acbfa3d9744ec63657810b3
---
M src/amr.c
1 file changed, 4 insertions(+), 4 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-netif refs/changes/93/30693/1
diff --git a/src/amr.c b/src/amr.c
index 1b750eb..8cd856d 100644
--- a/src/amr.c
+++ b/src/amr.c
@@ -214,11 +214,11 @@
return -1;
oa_payload_len = 2 + osmo_amr_bytes(oa_hdr->ft);
- for (i = 0; i < oa_payload_len - 3; i++) {
- buf[i + 2] = payload[i + 1] << 2;
- buf[i + 2] |= payload[i + 2] >> 6;
+ for (i = 2; i < oa_payload_len - 1; i++) {
+ buf[i] = payload[i - 1] << 2;
+ buf[i] |= payload[i] >> 6;
}
- buf[i + 2] = payload[i + 1] << 2;
+ buf[i] = payload[i - 1] << 2;
memcpy(payload, buf, oa_payload_len);
return oa_payload_len;
To view, visit change 30693. To unsubscribe, or for help writing mail filters, visit settings.