fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). am: c516539a20 

Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/12091300

Change-Id: I41058bf1a076509c564defa70247dcbfa91c64d0
This commit is contained in:
Fraunhofer IIS FDK 2020-09-09 22:02:14 +00:00 committed by Automerger Merge Worker
parent 5def92cb0f c516539a20
commit 17dd8dfad9
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libSBRdec/src/sbrdecoder.cpp
View File

@ -619,10 +619,6 @@ SBR_ERROR sbrDecoder_InitElement(
self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels; self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels;
} }
/* Save element ID for sanity checks and to have a fallback for concealment.
*/
self->pSbrElement[elementIndex]->elementID = elementID;
/* Determine amount of channels for this element */ /* Determine amount of channels for this element */
switch (elementID) { switch (elementID) {
case ID_NONE: case ID_NONE:
@ -655,12 +651,16 @@ SBR_ERROR sbrDecoder_InitElement(
} }
/* Sanity check to avoid memory leaks */ /* Sanity check to avoid memory leaks */
if (elChannels < self->pSbrElement[elementIndex]->nChannels) { if (elChannels < self->pSbrElement[elementIndex]->nChannels ||
(self->numSbrChannels + elChannels) > (8) + (1)) {
self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels; self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels;
sbrError = SBRDEC_PARSE_ERROR; sbrError = SBRDEC_PARSE_ERROR;
goto bail; goto bail;
} }
/* Save element ID for sanity checks and to have a fallback for concealment.
*/
self->pSbrElement[elementIndex]->elementID = elementID;
self->pSbrElement[elementIndex]->nChannels = elChannels; self->pSbrElement[elementIndex]->nChannels = elChannels;
for (ch = 0; ch < elChannels; ch++) { for (ch = 0; ch < elChannels; ch++) {