Add a check in the BlockBuffer of AEC2 to guard for buffer overflows.

webrtc/modules/audio_processing/aec/aec_core.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 184 matching lines @@
 void BlockBuffer::ReInit() {
   WebRtc_InitBuffer(buffer_);
 }
 
 void BlockBuffer::Insert(const float block[PART_LEN]) {
   WebRtc_WriteBuffer(buffer_, block, 1);
 }
 
 void BlockBuffer::ExtractExtendedBlock(float extended_block[PART_LEN2]) {
   float* block_ptr = NULL;
+  size_t read_elements;

[peah-webrtc, 2017/07/07 14:28:56]

I think you should move the declaration to line 210 where it is first used.

[saza WebRTC, 2017/07/10 06:53:16]

Done.

   RTC_DCHECK_LT(0, AvaliableSpace());
 
   // Extract the previous block.
   WebRtc_MoveReadPtr(buffer_, -1);
-  WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
-                    &extended_block[0], 1);
+  read_elements = WebRtc_ReadBuffer(
+      buffer_, reinterpret_cast<void**>(&block_ptr), &extended_block[0], 1);
+  RTC_CHECK_EQ(read_elements, 1);
   if (block_ptr != &extended_block[0]) {
     memcpy(&extended_block[0], block_ptr, PART_LEN * sizeof(float));
   }
 
   // Extract the current block.
-  WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
-                    &extended_block[PART_LEN], 1);
+  read_elements =
+      WebRtc_ReadBuffer(buffer_, reinterpret_cast<void**>(&block_ptr),
+                        &extended_block[PART_LEN], 1);
+  RTC_CHECK_EQ(read_elements, 1);
   if (block_ptr != &extended_block[PART_LEN]) {
     memcpy(&extended_block[PART_LEN], block_ptr, PART_LEN * sizeof(float));
   }
 }
 
 int BlockBuffer::AdjustSize(int buffer_size_decrease) {
   return WebRtc_MoveReadPtr(buffer_, buffer_size_decrease);
 }
 
 size_t BlockBuffer::Size() {
@@ skipping 1810 matching lines @@
 
 int WebRtcAec_system_delay(AecCore* self) {
   return self->system_delay;
 }
 
 void WebRtcAec_SetSystemDelay(AecCore* self, int delay) {
   RTC_DCHECK_GE(delay, 0);
   self->system_delay = delay;
 }
 }  // namespace webrtc