From 3d5ffe28ea8b9196b32301dcde9344a10d3e8ecb Mon Sep 17 00:00:00 2001 From: SoraYuki Date: Sat, 28 Sep 2019 15:59:20 +0800 Subject: [PATCH] [core] Fix FEC crash for access container out of range --- srtcore/fec.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/srtcore/fec.cpp b/srtcore/fec.cpp index 23eb2751e..ee82fe242 100644 --- a/srtcore/fec.cpp +++ b/srtcore/fec.cpp @@ -1517,7 +1517,7 @@ bool FECFilterBuiltin::IsLost(int32_t seq) const << " is earlier than the cell base %" << rcv.cell_base); return true; // fake we have the packet - this is to collect losses only } - if (offset > int(rcv.cells.size())) + if (offset >= int(rcv.cells.size())) { // XXX IPE! LOGC(mglog.Error, log << "FEC: IsLost: IPE: %" << seq << " is past the cells %" @@ -1709,6 +1709,12 @@ void FECFilterBuiltin::RcvCheckDismissColumn(int32_t seq, int colgx, loss_seqs_t << " with required %" << CSeqNo::incseq(base0, mindist) << " but col container size still " << rcv.colq.size()); } + else if (rcv.rowq.size() < numberRows()) + { + HLOGC(mglog.Debug, log << "FEC/V: IPE: about to dismiss past %" << seq + << " with required %" << CSeqNo::incseq(base0, mindist) + << " but row container size still " << rcv.rowq.size()); + } else { // The condition for dismissal is now. The number of dismissed columns