fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-06-05 22:39:13 +02:00
Code Issues Projects Releases Wiki Activity

Fix possible stack buffer overflow in mapIndexData().

Browse Source 
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I160e7174f32dabe386fce1e9ec67d3c8cea60c78
This commit is contained in:
Fraunhofer IIS FDK
2019-08-09 17:07:19 +02:00
committed by Jean-Michel Trivi
parent f26eb8af7c
commit 2b5217a953
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libSACdec/src/sac_bitdec.cpp
View File

@@ -1,7 +1,7 @@
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten © Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved. Forschung e.V. All rights reserved.
1. INTRODUCTION 1. INTRODUCTION
@@ -1554,22 +1554,20 @@ static SACDEC_ERROR mapIndexData(
/* Interpolate */ /* Interpolate */
i1 = 0; i1 = 0;
for (i = 0; i < numParameterSets; i++) { for (i = 0; i < numParameterSets; i++) {
int xi, i2, x1, x2;
if (aInterpolate[i] != 1) { if (aInterpolate[i] != 1) {
i1 = i; i1 = i;
} else {
int xi, i2, x1, x2;
for (i2 = i; i2 < numParameterSets; i2++) {
if (aInterpolate[i2] != 1) break;
} }
i2 = i; if (i2 >= numParameterSets) return MPS_WRONG_PARAMETERSETS;
while (aInterpolate[i2] == 1) {
i2++;
if (i2 >= MAX_PARAMETER_SETS) return MPS_WRONG_PARAMETERSETS;
}
x1 = paramSlot[i1]; x1 = paramSlot[i1];
xi = paramSlot[i]; xi = paramSlot[i];
x2 = paramSlot[i2]; x2 = paramSlot[i2];
if (aInterpolate[i] == 1) {
if (i2 >= numParameterSets) return MPS_WRONG_PARAMETERSETS;
for (band = startBand; band < stopBand; band++) { for (band = startBand; band < stopBand; band++) {
int yi, y1, y2; int yi, y1, y2;
y1 = outputIdxData[xttIdx][i1][band]; y1 = outputIdxData[xttIdx][i1][band];