fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Reapply: Avoid reading out of bounds due to too large aaIidIndexMapped 

Fixes: 10726/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBFDK_AAC_fuzzer-5167035365982208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
This commit is contained in:
Martin Storsjo 2017-11-20 12:35:32 +02:00
parent e6bb256130
commit 28fdc28ec4
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libSBRdec/src/psdec.cpp
View File

@ -325,7 +325,7 @@ void initSlotBasedRotation(
int env, int usb) { int env, int usb) {
INT group = 0; INT group = 0;
INT bin = 0; INT bin = 0;
INT noIidSteps; INT noIidSteps, noFactors;
FIXP_SGL invL; FIXP_SGL invL;
FIXP_DBL ScaleL, ScaleR; FIXP_DBL ScaleL, ScaleR;
@ -337,9 +337,11 @@ void initSlotBasedRotation(
if (h_ps_d->bsData[h_ps_d->processSlot].mpeg.bFineIidQ) { if (h_ps_d->bsData[h_ps_d->processSlot].mpeg.bFineIidQ) {
PScaleFactors = ScaleFactorsFine; /* values are shiftet right by one */ PScaleFactors = ScaleFactorsFine; /* values are shiftet right by one */
noIidSteps = NO_IID_STEPS_FINE; noIidSteps = NO_IID_STEPS_FINE;
noFactors = NO_IID_LEVELS_FINE;
} else { } else {
PScaleFactors = ScaleFactors; /* values are shiftet right by one */ PScaleFactors = ScaleFactors; /* values are shiftet right by one */
noIidSteps = NO_IID_STEPS; noIidSteps = NO_IID_STEPS;
noFactors = NO_IID_LEVELS;
} }
/* dequantize and decode */ /* dequantize and decode */
@ -358,8 +360,11 @@ void initSlotBasedRotation(
/* ScaleR and ScaleL are scaled by 1 shift right */ /* ScaleR and ScaleL are scaled by 1 shift right */
ScaleL = ScaleR = 0;
if (noIidSteps + h_ps_d->specificTo.mpeg.pCoef->aaIidIndexMapped[env][bin] >= 0 && noIidSteps + h_ps_d->specificTo.mpeg.pCoef->aaIidIndexMapped[env][bin] < noFactors)
ScaleR = PScaleFactors[noIidSteps + h_ps_d->specificTo.mpeg.pCoef ScaleR = PScaleFactors[noIidSteps + h_ps_d->specificTo.mpeg.pCoef
->aaIidIndexMapped[env][bin]]; ->aaIidIndexMapped[env][bin]];
if (noIidSteps - h_ps_d->specificTo.mpeg.pCoef->aaIidIndexMapped[env][bin] >= 0 && noIidSteps - h_ps_d->specificTo.mpeg.pCoef->aaIidIndexMapped[env][bin] < noFactors)
ScaleL = PScaleFactors[noIidSteps - h_ps_d->specificTo.mpeg.pCoef ScaleL = PScaleFactors[noIidSteps - h_ps_d->specificTo.mpeg.pCoef
->aaIidIndexMapped[env][bin]]; ->aaIidIndexMapped[env][bin]];