[asterisk-bugs] [JIRA] (ASTERISK-26926) Crash caused by missing check in func_speex.c with codec_siren14

[Richard Kenner (JIRA)]

Richard Kenner created ASTERISK-26926:
-----------------------------------------

             Summary: Crash caused by missing check in func_speex.c with codec_siren14
                 Key: ASTERISK-26926
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26926
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Functions/func_speex
    Affects Versions: 14.3.0
         Environment: Siren14 (and likely Siren7)
            Reporter: Richard Kenner


There is a crash in preprocess_analysis (st=0x2ac0740fd750, x=0x3cab9378) at preprocess.c:626 due to a frame being passed to func_speex.c looking like:  

(gdb) print *frame
$1 = {frametype = AST_FRAME_VOICE, subclass = {integer = 0, 
    format = 0xe2f9e20, frame_ending = 0}, datalen = 0, samples = 640, 
  mallocd = 1, mallocd_hdr_len = 232, offset = 64, 
  src = 0x2ac07413e7f8 "siren14tolin32", data = {ptr = 0x3cab9378, 
    uint32 = 1017877368, pad = "x\223\253<\000\000\000"}, delivery = {
    tv_sec = 1491485582, tv_usec = 407272}, frame_list = {next = 0x0}, 
  flags = 0, ts = 0, len = 0, seqno = 0}

A check for  datalen != 0 is missing before the call to speex_preprocess around line 188 of func_speex.c.

This was most recently seen with Siren14, but I believe also occurs less often with Siren7.



--
This message was sent by Atlassian JIRA
(v6.2#6252)