iSAC float: Check for end of input buffer while decoding

webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c

 /*
  *  Copyright (c) 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 167 matching lines @@
 {
   uint32_t    W_lower, W_upper;
   uint32_t    W_tmp;
   uint32_t    W_upper_LSB, W_upper_MSB;
   uint32_t    streamval;
   const uint8_t *stream_ptr;
   uint32_t    cdf_tmp;
   int16_t     candQ7;
   int             k;
 
+  // Position just past the end of the stream. STREAM_SIZE_MAX_60 instead of
+  // STREAM_SIZE_MAX (which is the size of the allocated buffer) because that's
+  // the limit to how much data is filled in.
+  const uint8_t* const stream_end = streamdata->stream + STREAM_SIZE_MAX_60;
+
   stream_ptr = streamdata->stream + streamdata->stream_index;
   W_upper = streamdata->W_upper;
   if (streamdata->stream_index == 0)   /* first time decoder is called for this stream */
   {
     /* read first word from bytestream */
+    if (stream_ptr + 3 >= stream_end)
+      return -1;  // Would read out of bounds. Malformed input?
     streamval = *stream_ptr << 24;
     streamval |= *++stream_ptr << 16;
     streamval |= *++stream_ptr << 8;
     streamval |= *++stream_ptr;
   } else {
     streamval = streamdata->streamval;
   }
 
 
   for (k = 0; k < N; k++)
@@ skipping 67 matching lines @@
     /* shift interval to start at zero */
     W_upper -= ++W_lower;
 
     /* add integer to bitstream */
     streamval -= W_lower;
 
     /* renormalize interval and update streamval */
     while ( !(W_upper & 0xFF000000) )    /* W_upper < 2^24 */
     {
       /* read next byte from stream */
+      if (stream_ptr + 1 >= stream_end)
+        return -1;  // Would read out of bounds. Malformed input?
       streamval = (streamval << 8) | *++stream_ptr;
       W_upper <<= 8;
     }
   }
 
   streamdata->stream_index = (int)(stream_ptr - streamdata->stream);
   streamdata->W_upper = W_upper;
   streamdata->streamval = streamval;
 
   /* find number of bytes in original stream (determined by current interval width) */
   if ( W_upper > 0x01FFFFFF )
     return streamdata->stream_index - 2;
   else
     return streamdata->stream_index - 1;
 }