trau_mux.c: Prevent out-of-bounds read in trau_encode_fr()

found by -fsanitize=address the last iteration of the loop, where i ==
259 and o == 260.  It is read out-of-bounds but the content is never
used.
This commit is contained in:
Harald Welte 2014-06-23 09:48:07 +02:00
parent db0caf239e
commit 9f109dfb99
1 changed files with 3 additions and 0 deletions

View File

@ -436,6 +436,9 @@ void trau_encode_fr(struct decoded_trau_frame *tf,
o = 0; /* offset output bits */
while (i < 260) {
tf->d_bits[k+o] = (data[j/8] >> (7-(j%8))) & 1;
/* to avoid out-of-bounds access in gsm_fr_map[++l] */
if (i == 259)
break;
if (--k < 0) {
o += gsm_fr_map[l];
k = gsm_fr_map[++l]-1;