From d3be3d7b96a5130e4b20f23e327b040ea4d0b079 Mon Sep 17 00:00:00 2001
From: Mikkel Krautz <mikkel@krautz.dk>
Date: Fri, 31 Jan 2014 19:32:28 +0100
Subject: [PATCH] mumble: fix Mumble-SA-2014-002 (CVE-2014-0045).

---
 src/mumble/AudioOutputSpeech.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/mumble/AudioOutputSpeech.cpp b/src/mumble/AudioOutputSpeech.cpp
index e676e90ec..0edb3b293 100644
--- a/src/mumble/AudioOutputSpeech.cpp
+++ b/src/mumble/AudioOutputSpeech.cpp
@@ -342,6 +342,10 @@ bool AudioOutputSpeech::needSamples(unsigned int snum) {
 					                                   pOut,
 					                                   iAudioBufferSize,
 					                                   0);
+					if (decodedSamples < 0) {
+						decodedSamples = iFrameSize;
+						memset(pOut, 0, iFrameSize * sizeof(float));
+					}
 #endif
 				} else {
 					if (qba.isEmpty()) {
@@ -391,6 +395,10 @@ bool AudioOutputSpeech::needSamples(unsigned int snum) {
 				} else if (umtType == MessageHandler::UDPVoiceOpus) {
 #ifdef USE_OPUS
 					decodedSamples = opus_decode_float(opusState, NULL, 0, pOut, iFrameSize, 0);
+					if (decodedSamples < 0) {
+						decodedSamples = iFrameSize;
+						memset(pOut, 0, iFrameSize * sizeof(float));
+					}
 #endif
 				} else {
 					speex_decode(dsSpeex, NULL, pOut);