fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-06-05 22:39:13 +02:00
Code Issues Projects Releases Wiki Activity

Avoid reading out of bounds due to too large aaIidIndexMapped

Browse Source 
Fixes: 4151/clusterfuzz-testcase-4854089193095168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
This commit is contained in:
Martin Storsjo
2017-11-20 12:35:32 +02:00
parent 1e3515e03e
commit 56c717e223
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libSBRdec/src/psdec.cpp
View File

@@ -938,7 +938,7 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
INT group = 0;
INT bin = 0;
INT noIidSteps;
INT noIidSteps, noFactors;
/* const UCHAR *pQuantizedIIDs;*/
@@ -984,6 +984,7 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
{
PScaleFactors = ScaleFactorsFine; /* values are shiftet right by one */
noIidSteps = NO_IID_STEPS_FINE;
noFactors = NO_IID_LEVELS_FINE;
/*pQuantizedIIDs = quantizedIIDsFine;*/
}
@@ -991,6 +992,7 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
{
PScaleFactors = ScaleFactors; /* values are shiftet right by one */
noIidSteps = NO_IID_STEPS;
noFactors = NO_IID_LEVELS;
/*pQuantizedIIDs = quantizedIIDs;*/
}
@@ -1012,7 +1014,10 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
/* ScaleR and ScaleL are scaled by 1 shift right */
ScaleL = ScaleR = 0;
if (noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] >= 0 && noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] < noFactors)
ScaleR = PScaleFactors[noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
if (noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] >= 0 && noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] < noFactors)
ScaleL = PScaleFactors[noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
AlphasValue = 0;