FS-7479 Fixed a crash caused by large RTP/PCMA packets and resampling

diff --git a/src/include/switch_resample.h b/src/include/switch_resample.h
index c899246f772acec98907a5160a632db3cb378da5..b3fb436c86033412535b7dff6023cd8a4a0cdc89 100644 (file)
--- a/src/include/switch_resample.h
+++ b/src/include/switch_resample.h
@@ -175,6 +175,9 @@ SWITCH_DECLARE(uint32_t) switch_merge_sln(int16_t *data, uint32_t samples, int16
 SWITCH_DECLARE(uint32_t) switch_unmerge_sln(int16_t *data, uint32_t samples, int16_t *other_data, uint32_t other_samples, int channels);
 SWITCH_DECLARE(void) switch_mux_channels(int16_t *data, switch_size_t samples, uint32_t orig_channels, uint32_t channels);
 
+#define switch_resample_calc_buffer_size(_to, _from, _srclen) ((uint32_t)(((float)_to / (float)_from) * (float)_srclen) * 2)
+
+                                                
 SWITCH_END_EXTERN_C
 #endif
 /* For Emacs:

diff --git a/src/switch_core_io.c b/src/switch_core_io.c
index 4d5ffb7c70a6ed51f621d7960295f228390459fe..8a2920b452a47b51bc3fb4f4761262deb4b3b45d 100644 (file)
--- a/src/switch_core_io.c
+++ b/src/switch_core_io.c
@@ -1334,6 +1334,17 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_write_frame(switch_core_sess
                switch_mutex_lock(session->resample_mutex);
                if (session->write_resampler) {
 
+                       if (switch_resample_calc_buffer_size(session->write_resampler->to_rate, session->write_resampler->from_rate,
+                                                                                                write_frame->datalen / 2 / session->write_resampler->channels) > SWITCH_RECOMMENDED_BUFFER_SIZE) {
+                               
+                               switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_CRIT, "%s not enough buffer space for required resample operation!\n",
+                                                                 switch_channel_get_name(session->channel));
+                               switch_channel_hangup(session->channel, SWITCH_CAUSE_DESTINATION_OUT_OF_ORDER);
+                               switch_mutex_unlock(session->resample_mutex);
+                               goto error;
+                       }
+               
+
                        switch_resample_process(session->write_resampler, data, write_frame->datalen / 2 / session->write_resampler->channels);
 
                        memcpy(data, session->write_resampler->to, session->write_resampler->to_len * 2 * session->write_resampler->channels);

diff --git a/src/switch_resample.c b/src/switch_resample.c
index 2f12c1cadeedf188d45cbbe289f2075717a49dc0..d9f041b55fd964616df1774ad05b3aa41b6cb889 100644 (file)
--- a/src/switch_resample.c
+++ b/src/switch_resample.c
@@ -63,7 +63,9 @@ SWITCH_DECLARE(switch_status_t) switch_resample_perform_create(switch_audio_resa
 
        switch_zmalloc(resampler, sizeof(*resampler));
 
-       resampler->resampler = speex_resampler_init(channels ? channels : 1, from_rate, to_rate, quality, &err);
+       if (!channels) channels = 1;
+       
+       resampler->resampler = speex_resampler_init(channels, from_rate, to_rate, quality, &err);
 
        if (!resampler->resampler) {
                free(resampler);
@@ -77,16 +79,27 @@ SWITCH_DECLARE(switch_status_t) switch_resample_perform_create(switch_audio_resa
        resampler->to_rate = to_rate;
        resampler->factor = (lto_rate / lfrom_rate);
        resampler->rfactor = (lfrom_rate / lto_rate);
-       resampler->to_size = resample_buffer(to_rate, from_rate, (uint32_t) to_size);
-       resampler->to = malloc(resampler->to_size * sizeof(int16_t) * (channels ? channels : 1));
        resampler->channels = channels;
+       
+       //resampler->to_size = resample_buffer(to_rate, from_rate, (uint32_t) to_size);
+
+       resampler->to_size = switch_resample_calc_buffer_size(resampler->to_rate, resampler->from_rate, to_size) / 2;
+       resampler->to = malloc(resampler->to_size * sizeof(int16_t) * resampler->channels);
+       switch_assert(resampler->to);
 
        return SWITCH_STATUS_SUCCESS;
 }
 
-
 SWITCH_DECLARE(uint32_t) switch_resample_process(switch_audio_resampler_t *resampler, int16_t *src, uint32_t srclen)
 {
+       int to_size = switch_resample_calc_buffer_size(resampler->to_rate, resampler->from_rate, srclen) / 2;
+
+       if (to_size > resampler->to_size) {
+               resampler->to_size = to_size;
+               resampler->to = realloc(resampler->to, resampler->to_size * sizeof(int16_t) * resampler->channels);
+               switch_assert(resampler->to);
+       }
+       
        resampler->to_len = resampler->to_size;
        speex_resampler_process_interleaved_int(resampler->resampler, src, &srclen, resampler->to, &resampler->to_len);
        return resampler->to_len;