From 1f5fac767af24805fbd9e25bd5d6a719e8a1e3cc Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 17 Apr 2020 15:13:35 +0200
Subject: [PATCH] Adjust data types to prevent load of invalid value

Adjust usacExtElementType data type to prevent load of invalid
value in extElementConfig().

Adjust usacConfigExtType data type to prevent load of invalid
value in configExtension().

Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Ide15daa73c084c4a2cfc9d0f36bd7666fa6bac7a
---
 libMpegTPDec/src/tpdec_asc.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index e46cb32..8f77017 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -1694,8 +1694,7 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement,
                                            const AUDIO_OBJECT_TYPE aot) {
   TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
 
-  USAC_EXT_ELEMENT_TYPE usacExtElementType =
-      (USAC_EXT_ELEMENT_TYPE)escapedValue(hBs, 4, 8, 16);
+  UINT usacExtElementType = escapedValue(hBs, 4, 8, 16);
 
   /* recurve extension elements which are invalid for USAC */
   if (aot == AOT_USAC) {
@@ -1712,7 +1711,6 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement,
     }
   }
 
-  extElement->usacExtElementType = usacExtElementType;
   int usacExtElementConfigLength = escapedValue(hBs, 4, 8, 16);
   extElement->usacExtElementConfigLength = (USHORT)usacExtElementConfigLength;
   INT bsAnchor;
@@ -1746,8 +1744,10 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement,
       }
     } break;
     default:
+      usacExtElementType = ID_EXT_ELE_UNKNOWN;
       break;
   }
+  extElement->usacExtElementType = (USAC_EXT_ELEMENT_TYPE)usacExtElementType;
 
   /* Adjust bit stream position. This is required because of byte alignment and
    * unhandled extensions. */
@@ -1776,7 +1776,7 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc,
   TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
 
   int numConfigExtensions;
-  CONFIG_EXT_ID usacConfigExtType;
+  UINT usacConfigExtType;
   int usacConfigExtLength;
   int loudnessInfoSetIndex =
       -1; /* index of loudnessInfoSet config extension. -1 if not contained. */
@@ -1787,7 +1787,7 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc,
   for (int confExtIdx = 0; confExtIdx < numConfigExtensions; confExtIdx++) {
     INT nbits;
     int loudnessInfoSetConfigExtensionPosition = FDKgetValidBits(hBs);
-    usacConfigExtType = (CONFIG_EXT_ID)escapedValue(hBs, 4, 8, 16);
+    usacConfigExtType = escapedValue(hBs, 4, 8, 16);
     usacConfigExtLength = (int)escapedValue(hBs, 4, 8, 16);
 
     /* Start bit position of config extension */