amr: fix off-by-one in osmo_amr_bwe_to_oa()

The for loop in osmo_amr_bwe_to_oa, that converts the body part of the
AMR payload runs one byte too far. This may cause that some of the
padding bits in the end are not set to zero. The loop is designed to
convert n-1 bytes and the nth byte is done separately at the end.

Change-Id: I91e755b83aaac722079879c026d913cc446812d1

1 files changed, 1 insertions, 1 deletions

diff --git a/src/amr.c b/src/amr.c
index 980d6ad..2706432 100644
--- a/src/amr.c
+++ b/src/amr.c
@@ -198,7 +198,7 @@ int osmo_amr_bwe_to_oa(uint8_t *payload, unsigned int payload_len,
 		return -1;
 	oa_payload_len = 2 + osmo_amr_bytes(oa_hdr->ft);
 
-	for (i = 0; i < oa_payload_len - 2; i++) {
+	for (i = 0; i < oa_payload_len - 3; i++) {
 		buf[i + 2] = payload[i + 1] << 2;
 		buf[i + 2] |= payload[i + 2] >> 6;
 	}