iSAC float: Check for end of input buffer while decoding

webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c

Index: webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c
diff --git a/webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c b/webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c
index eeed7ae5530fd36d842aa2549653ff6cc9dd62c4..afc8544f07742c4009dec0a6643d50c591186df1 100644
--- a/webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c
+++ b/webrtc/modules/audio_coding/codecs/isac/main/source/arith_routines_logist.c
@@ -190,6 +190,8 @@ int WebRtcIsac_DecLogisticMulti2(
   if (streamdata->stream_index == 0)   /* first time decoder is called for this stream */
   {
     /* read first word from bytestream */
+    if (stream_ptr + 3 - streamdata->stream >= STREAM_SIZE_MAX_60)

[hlundin-webrtc, 2016/02/23 13:16:10]

Please, comment on why you use STREAM_SIZE_MAX_60 instead of STREAM_SIZE_MAX.

[kwiberg-webrtc, 2016/02/23 13:48:02]

I extracted a named constant. Pretty?

+      return -1;  // Would read out of bounds. Malformed input?
     streamval = *stream_ptr << 24;
     streamval |= *++stream_ptr << 16;
     streamval |= *++stream_ptr << 8;
@@ -277,6 +279,8 @@ int WebRtcIsac_DecLogisticMulti2(
     while ( !(W_upper & 0xFF000000) )    /* W_upper < 2^24 */
     {
       /* read next byte from stream */
+      if (stream_ptr + 1 - streamdata->stream >= STREAM_SIZE_MAX_60)

[hlundin-webrtc, 2016/02/23 13:16:10]

and here.

+        return -1;  // Would read out of bounds. Malformed input?
       streamval = (streamval << 8) | *++stream_ptr;
       W_upper <<= 8;
     }