From 25e30a6ba72c24dae629243e7eb23f3d8af9867b Mon Sep 17 00:00:00 2001 From: Dmytro Bogovych Date: Mon, 6 Jul 2026 12:33:37 +0300 Subject: [PATCH] - stop properly on bad AMR packets --- src/engine/media/MT_AmrCodec.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/engine/media/MT_AmrCodec.cpp b/src/engine/media/MT_AmrCodec.cpp index 8c1550d6..44e846dd 100644 --- a/src/engine/media/MT_AmrCodec.cpp +++ b/src/engine/media/MT_AmrCodec.cpp @@ -94,8 +94,20 @@ static AmrPayload parseAmrPayload(AmrPayloadInfo& input, size_t& cngCounter) // Table of contents uint8_t F, FT, Q; + // Bits consumed by a single ToC entry: F(1) + FT(4) + Q(1), plus 2 padding + // bits in octet-aligned mode. + const size_t tocEntryBits = input.mOctetAligned ? 8 : 6; + do { + // Stop when the payload no longer holds a full ToC entry. BitReader + // saturates at end-of-stream (re-reads the last bit) instead of + // signalling EOF, so trusting the F continuation bit alone would loop + // forever - and append AmrFrames unbounded - on a truncated or crafted + // payload whose final bit is 1. + if (bit_reader.position() + tocEntryBits > bit_reader.count()) + break; + // Read TOC. It is still relates to RTP part of AMR frames packing; not the AMR frame itself. // F (1 bit): If set to 1, indicates that this frame is followed by // another speech frame in this payload; if set to 0, indicates that