From 22e70729b4bf541ea507dda074e368dd00e29d0c Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Mon, 6 Jul 2020 16:39:15 +0200 Subject: [PATCH] Fix stack buffer overflow in Pred_lt4(). Bug: 186706541 Bug: 160187491 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: I3b8d9326319cca21145cc246588b01c5bf29a9a0 --- libAACdec/src/usacdec_acelp.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libAACdec/src/usacdec_acelp.cpp b/libAACdec/src/usacdec_acelp.cpp index a8dadc0..ca1a6a2 100644 --- a/libAACdec/src/usacdec_acelp.cpp +++ b/libAACdec/src/usacdec_acelp.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -719,7 +719,7 @@ static void ConcealPitchLag(CAcelpStaticMem *acelp_mem, const int PIT_MAX, UCHAR *pold_T0_frac = &acelp_mem->old_T0_frac; if ((int)*pold_T0 >= PIT_MAX) { - *pold_T0 = (UCHAR)(PIT_MAX - 5); + *pold_T0 = (USHORT)(PIT_MAX - 5); } *pT0 = (int)*pold_T0; *pT0_frac = (int)*pold_T0_frac;