Fix out-of-buffer read in iLBC

webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c

Index: webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c
diff --git a/webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c b/webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c
index 8ae28ac3b9962735069b2b5d6db1d3b4ae49edbc..6b2307c23715c996bb2c9490e08d292a3a99907d 100644
--- a/webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c
+++ b/webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c
@@ -18,6 +18,7 @@
 
 #include "defines.h"
 #include "constants.h"
+#include "webrtc/common_audio/signal_processing/include/signal_processing_library.h"
 
 /*----------------------------------------------------------------*
  *  Recreate a specific codebook vector from the augmented part.
@@ -53,5 +54,15 @@ void WebRtcIlbcfix_CreateAugmentedVec(
 
   /* copy the second noninterpolated part */
   ppo = buffer - index;
-  WEBRTC_SPL_MEMCPY_W16(cbVec+index,ppo,(SUBL-index));
+  /* |tempbuff2| is declared in WebRtcIlbcfix_GetCbVec and is SUBL+5 elements
+     long. |buffer| points one element past the end of that vector, i.e., at
+     tempbuff2+SUBL+5. Since ppo=buffer-index, we cannot read any more than
+     |index| elements from |ppo|.
+
+     |cbVec| is declared to be SUBL elements long in WebRtcIlbcfix_CbConstruct.
+     Therefore, we can only write SUBL-index elements to cbVec+index.
+
+     These two conditions limit the number of elements to copy.
+   */
+  WEBRTC_SPL_MEMCPY_W16(cbVec+index, ppo, WEBRTC_SPL_MIN(SUBL-index, index));
 }