iLBC: Handle a case of bad input data

webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c

Index: webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c
diff --git a/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c b/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c
index d7c2e75553b8e5225ace669f2fb258e0d5215c8e..27bd7389ee3979dba8ef946b6560d2bc7d36ca43 100644
--- a/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c
+++ b/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c
@@ -24,7 +24,7 @@
  *  Construct codebook vector for given index.
  *---------------------------------------------------------------*/
 
-void WebRtcIlbcfix_GetCbVec(
+int WebRtcIlbcfix_GetCbVec(
     int16_t *cbvec,   /* (o) Constructed codebook vector */
     int16_t *mem,   /* (i) Codebook buffer */
     size_t index,   /* (i) Codebook index */
@@ -93,6 +93,17 @@ void WebRtcIlbcfix_GetCbVec(
     /* interpolated vectors */
 
     else {
+      if (cbveclen < SUBL) {
+        // We're going to fill in cbveclen + 5 elements of tempbuff2 in
+        // WebRtcSpl_FilterMAFastQ12, less than the SUBL + 5 elements we'll be
+        // using in WebRtcIlbcfix_CreateAugmentedVec. This error is caused by
+        // bad values in |index| (which come from the encoded stream). Tell the
+        // caller that things went south, and that the decoder state is now
+        // corrupt (because it's half-way through an update that we can't
+        // complete).
+        return 0;
+      }
+
       /* Stuff zeros outside memory buffer  */
       memIndTest = lMem-cbveclen-CB_FILTERLEN;
       WebRtcSpl_MemSetW16(mem+lMem, 0, CB_HALFFILTERLEN);
@@ -108,4 +119,6 @@ void WebRtcIlbcfix_GetCbVec(
       WebRtcIlbcfix_CreateAugmentedVec(lag, tempbuff2+SUBL+5, cbvec);
     }
   }
+
+  return 1;  // Success.
 }