Fix out-of-buffer read in iLBC

webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c

 /*
  *  Copyright (c) 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 /******************************************************************
 
  iLBC Speech Coder ANSI-C Source Code
 
  WebRtcIlbcfix_CreateAugmentedVec.c
 
 ******************************************************************/
 
 #include "defines.h"
 #include "constants.h"
+#include "webrtc/common_audio/signal_processing/include/signal_processing_library.h"
 
 /*----------------------------------------------------------------*
  *  Recreate a specific codebook vector from the augmented part.
  *
  *----------------------------------------------------------------*/
 
 void WebRtcIlbcfix_CreateAugmentedVec(
     size_t index,  /* (i) Index for the augmented vector to be created */
     int16_t *buffer,  /* (i) Pointer to the end of the codebook memory that
                                            is used for creation of the augmented codebook */
@@ skipping 15 matching lines @@
 
   /* perform cbVec[ilow+k] = ((ppi[k]*alphaTbl[k])>>15) + ((ppo[k]*alphaTbl[3-k])>>15);
      for k = 0..3
   */
   WebRtcSpl_ElementwiseVectorMult(&cbVec[ilow], ppi, WebRtcIlbcfix_kAlpha, 4, 15);
   WebRtcSpl_ReverseOrderMultArrayElements(cbVecTmp, ppo, &WebRtcIlbcfix_kAlpha[3], 4, 15);
   WebRtcSpl_AddVectorsAndShift(&cbVec[ilow], &cbVec[ilow], cbVecTmp, 4, 0);
 
   /* copy the second noninterpolated part */
   ppo = buffer - index;
-  WEBRTC_SPL_MEMCPY_W16(cbVec+index,ppo,(SUBL-index));
+  /* |tempbuff2| is declared in WebRtcIlbcfix_GetCbVec and is SUBL+5 elements
+     long. |buffer| points one element past the end of that vector, i.e., at
+     tempbuff2+SUBL+5. Since ppo=buffer-index, we cannot read any more than
+     |index| elements from |ppo|.
+
+     |cbVec| is declared to be SUBL elements long in WebRtcIlbcfix_CbConstruct.
+     Therefore, we can only write SUBL-index elements to cbVec+index.
+
+     These two conditions limit the number of elements to copy.
+   */
+  WEBRTC_SPL_MEMCPY_W16(cbVec+index, ppo, WEBRTC_SPL_MIN(SUBL-index, index));
 }