iSAC float: Handle errors in upper band decoding

webrtc/modules/audio_coding/codecs/isac/main/source/isac.c

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 1235 matching lines @@
           }
           case isac16kHz: {
             numDecodedBytesUB = WebRtcIsac_DecodeUb16(
                 &instISAC->transform_tables, outFrame, decInstUB, isRCUPayload);
             break;
           }
           default:
             return -1;
         }
 
+        if (numDecodedBytesUB < 0) {
+          instISAC->errorCode = numDecodedBytesUB;
+          return -1;
+        }
+        if (numDecodedBytesLB + numDecodedBytesUB > lenEncodedBytes) {
+          // We have supposedly decoded more bytes than we were given. Likely
+          // caused by bad input data.
+          instISAC->errorCode = ISAC_LENGTH_MISMATCH;
+          return -1;
+        }
+
         /* It might be less due to garbage. */
         if ((numDecodedBytesUB != lenNextStream) &&
             (numDecodedBytesUB != (lenNextStream -
                 encoded[numDecodedBytesLB + 1 + numDecodedBytesUB]))) {
           instISAC->errorCode = ISAC_LENGTH_MISMATCH;
           return -1;
         }
 
         /* If there is no error Upper-band always decodes
          * 30 ms (480 samples). */
@@ skipping 1088 matching lines @@
 }
 
 void WebRtcIsac_SetEncSampRateInDecoder(ISACStruct* inst,
                                         int sample_rate_hz) {
   ISACMainStruct* instISAC = (ISACMainStruct*)inst;
   assert(instISAC->initFlag & BIT_MASK_DEC_INIT);
   assert(!(instISAC->initFlag & BIT_MASK_ENC_INIT));
   assert(sample_rate_hz == 16000 || sample_rate_hz == 32000);
   instISAC->encoderSamplingRateKHz = sample_rate_hz / 1000;
 }