FS-7479 Fixed a crash caused by large RTP/PCMA packets and resampling

src/include/switch_resample.h

@@ -175,6 +175,9 @@ SWITCH_DECLARE(uint32_t) switch_merge_sln(int16_t *data, uint32_t samples, int16
 SWITCH_DECLARE(uint32_t) switch_unmerge_sln(int16_t *data, uint32_t samples, int16_t *other_data, uint32_t other_samples, int channels);
 SWITCH_DECLARE(void) switch_mux_channels(int16_t *data, switch_size_t samples, uint32_t orig_channels, uint32_t channels);
 
+#define switch_resample_calc_buffer_size(_to, _from, _srclen) ((uint32_t)(((float)_to / (float)_from) * (float)_srclen) * 2)
+
+						 
 SWITCH_END_EXTERN_C
 #endif
 /* For Emacs:

src/switch_core_io.c

@@ -1334,6 +1334,17 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_write_frame(switch_core_sess
 		switch_mutex_lock(session->resample_mutex);
 		if (session->write_resampler) {
 
+			if (switch_resample_calc_buffer_size(session->write_resampler->to_rate, session->write_resampler->from_rate,
+												 write_frame->datalen / 2 / session->write_resampler->channels) > SWITCH_RECOMMENDED_BUFFER_SIZE) {
+				
+				switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_CRIT, "%s not enough buffer space for required resample operation!\n",
+								  switch_channel_get_name(session->channel));
+				switch_channel_hangup(session->channel, SWITCH_CAUSE_DESTINATION_OUT_OF_ORDER);
+				switch_mutex_unlock(session->resample_mutex);
+				goto error;
+			}
+		
+
 			switch_resample_process(session->write_resampler, data, write_frame->datalen / 2 / session->write_resampler->channels);
 
 			memcpy(data, session->write_resampler->to, session->write_resampler->to_len * 2 * session->write_resampler->channels);

src/switch_resample.c

@@ -63,7 +63,9 @@ SWITCH_DECLARE(switch_status_t) switch_resample_perform_create(switch_audio_resa
 
 	switch_zmalloc(resampler, sizeof(*resampler));
 
-	resampler->resampler = speex_resampler_init(channels ? channels : 1, from_rate, to_rate, quality, &err);
+	if (!channels) channels = 1;
+	
+	resampler->resampler = speex_resampler_init(channels, from_rate, to_rate, quality, &err);
 
 	if (!resampler->resampler) {
 		free(resampler);
@@ -77,16 +79,27 @@ SWITCH_DECLARE(switch_status_t) switch_resample_perform_create(switch_audio_resa
 	resampler->to_rate = to_rate;
 	resampler->factor = (lto_rate / lfrom_rate);
 	resampler->rfactor = (lfrom_rate / lto_rate);
-	resampler->to_size = resample_buffer(to_rate, from_rate, (uint32_t) to_size);
-	resampler->to = malloc(resampler->to_size * sizeof(int16_t) * (channels ? channels : 1));
 	resampler->channels = channels;
+	
+	//resampler->to_size = resample_buffer(to_rate, from_rate, (uint32_t) to_size);
+
+	resampler->to_size = switch_resample_calc_buffer_size(resampler->to_rate, resampler->from_rate, to_size) / 2;
+	resampler->to = malloc(resampler->to_size * sizeof(int16_t) * resampler->channels);
+	switch_assert(resampler->to);
 
 	return SWITCH_STATUS_SUCCESS;
 }
 
-
 SWITCH_DECLARE(uint32_t) switch_resample_process(switch_audio_resampler_t *resampler, int16_t *src, uint32_t srclen)
 {
+	int to_size = switch_resample_calc_buffer_size(resampler->to_rate, resampler->from_rate, srclen) / 2;
+
+	if (to_size > resampler->to_size) {
+		resampler->to_size = to_size;
+		resampler->to = realloc(resampler->to, resampler->to_size * sizeof(int16_t) * resampler->channels);
+		switch_assert(resampler->to);
+	}
+	
 	resampler->to_len = resampler->to_size;
 	speex_resampler_process_interleaved_int(resampler->resampler, src, &srclen, resampler->to, &resampler->to_len);
 	return resampler->to_len;