From da4ef6481e1c7f78d73a86b57bb089fcde6217c1 Mon Sep 17 00:00:00 2001
From: jfreegman <jfreegman@gmail.com>
Date: Mon, 31 Jan 2022 14:14:23 -0500
Subject: [PATCH] Add some toxav bounds/sanity checks

---
 toxav/audio.c | 14 ++++----------
 toxav/rtp.c   |  2 +-
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/toxav/audio.c b/toxav/audio.c
index a0155d53..39882778 100644
--- a/toxav/audio.c
+++ b/toxav/audio.c
@@ -157,7 +157,7 @@ void ac_iterate(ACSession *ac)
             }
 
 #endif
-
+            assert(msg->len > 4);
 
             /* Pick up sampling rate from packet */
             memcpy(&ac->lp_sampling_rate, msg->data, 4);
@@ -210,10 +210,7 @@ void ac_iterate(ACSession *ac)
 int ac_queue_message(Mono_Time *mono_time, void *acp, struct RTPMessage *msg)
 {
     if (!acp || !msg) {
-        if (msg) {
-            free(msg);
-        }
-
+        free(msg);
         return -1;
     }
 
@@ -295,11 +292,8 @@ static struct JitterBuffer *jbuf_new(uint32_t capacity)
 static void jbuf_clear(struct JitterBuffer *q)
 {
     while (q->bottom != q->top) {
-        if (q->queue[q->bottom % q->size]) {
-            free(q->queue[q->bottom % q->size]);
-            q->queue[q->bottom % q->size] = nullptr;
-        }
-
+        free(q->queue[q->bottom % q->size]);
+        q->queue[q->bottom % q->size] = nullptr;
         ++q->bottom;
     }
 }
diff --git a/toxav/rtp.c b/toxav/rtp.c
index 8b245032..9f55f696 100644
--- a/toxav/rtp.c
+++ b/toxav/rtp.c
@@ -218,7 +218,7 @@ static struct RTPMessage *process_frame(const Logger *log, struct RTPWorkBufferL
     struct RTPMessage *const m_new = slot->buf;
     slot->buf = nullptr;
 
-    assert(wkbl->next_free_entry >= 1);
+    assert(wkbl->next_free_entry >= 1 && wkbl->next_free_entry <= USED_RTP_WORKBUFFER_COUNT);
 
     if (slot_id != wkbl->next_free_entry - 1) {
         // The slot is not the last slot, so we created a gap. We move all the