Add a check in the BlockBuffer of AEC2 to guard for buffer overflows.

webrtc/common_audio/ring_buffer.c

 /*
  *  Copyright (c) 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 100 matching lines @@
     void* buf_ptr_1 = NULL;
     void* buf_ptr_2 = NULL;
     size_t buf_ptr_bytes_1 = 0;
     size_t buf_ptr_bytes_2 = 0;
     const size_t read_count = GetBufferReadRegions(self,
                                                    element_count,
                                                    &buf_ptr_1,
                                                    &buf_ptr_bytes_1,
                                                    &buf_ptr_2,
                                                    &buf_ptr_bytes_2);
-
     if (buf_ptr_bytes_2 > 0) {
       // We have a wrap around when reading the buffer. Copy the buffer data to
       // |data| and point to it.
       memcpy(data, buf_ptr_1, buf_ptr_bytes_1);
       memcpy(((char*) data) + buf_ptr_bytes_1, buf_ptr_2, buf_ptr_bytes_2);
       buf_ptr_1 = data;
     } else if (!data_ptr) {
       // No wrap, but a memcpy was requested.
       memcpy(data, buf_ptr_1, buf_ptr_bytes_1);
     }
     if (data_ptr) {
       // |buf_ptr_1| == |data| in the case of a wrap.
-      *data_ptr = buf_ptr_1;
+      *data_ptr = read_count == 0 ? NULL : buf_ptr_1;
     }
 
     // Update read position
     WebRtc_MoveReadPtr(self, (int) read_count);
 
     return read_count;
   }
 }
 
 size_t WebRtc_WriteBuffer(RingBuffer* self,
@@ skipping 79 matching lines @@
   }
 }
 
 size_t WebRtc_available_write(const RingBuffer* self) {
   if (!self) {
     return 0;
   }
 
   return self->element_count - WebRtc_available_read(self);
 }