fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge "Add valid bits check to adts header parser" am: b622299482 

am: ffb999bec4

Change-Id: I9769e9e7152cc5294f3b1a925487938803f40878
This commit is contained in:
Jean-Michel Trivi 2018-12-28 15:19:34 -08:00 committed by android-build-merger
parent 7b664f0bea ffb999bec4
commit 61b5f49362
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libMpegTPDec/src/tpdec_adts.cpp
View File

@ -180,7 +180,11 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
have channelConfig=0 and no PCE in this frame. */ have channelConfig=0 and no PCE in this frame. */
FDKmemcpy(&oldPce, &pAsc->m_progrConfigElement, sizeof(CProgramConfig)); FDKmemcpy(&oldPce, &pAsc->m_progrConfigElement, sizeof(CProgramConfig));
valBits = FDKgetValidBits(hBs); valBits = FDKgetValidBits(hBs) + ADTS_SYNCLENGTH;
if (valBits < ADTS_HEADERLENGTH) {
return TRANSPORTDEC_NOT_ENOUGH_BITS;
}
/* adts_fixed_header */ /* adts_fixed_header */
bs.mpeg_id = FDKreadBits(hBs, Adts_Length_Id); bs.mpeg_id = FDKreadBits(hBs, Adts_Length_Id);
@ -205,6 +209,10 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
adtsHeaderLength = ADTS_HEADERLENGTH; adtsHeaderLength = ADTS_HEADERLENGTH;
if (valBits < bs.frame_length * 8) {
goto bail;
}
if (!bs.protection_absent) { if (!bs.protection_absent) {
FDKcrcReset(&pAdts->crcInfo); FDKcrcReset(&pAdts->crcInfo);
FDKpushBack(hBs, 56); /* complete fixed and variable header! */ FDKpushBack(hBs, 56); /* complete fixed and variable header! */
@ -213,6 +221,9 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
} }
if (!bs.protection_absent && bs.num_raw_blocks > 0) { if (!bs.protection_absent && bs.num_raw_blocks > 0) {
if ((INT)FDKgetValidBits(hBs) < bs.num_raw_blocks * 16) {
goto bail;
}
for (i = 0; i < bs.num_raw_blocks; i++) { for (i = 0; i < bs.num_raw_blocks; i++) {
pAdts->rawDataBlockDist[i] = (USHORT)FDKreadBits(hBs, 16); pAdts->rawDataBlockDist[i] = (USHORT)FDKreadBits(hBs, 16);
adtsHeaderLength += 16; adtsHeaderLength += 16;
@ -230,6 +241,11 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
USHORT crc_check; USHORT crc_check;
FDKcrcEndReg(&pAdts->crcInfo, hBs, crcReg); FDKcrcEndReg(&pAdts->crcInfo, hBs, crcReg);
if ((INT)FDKgetValidBits(hBs) < Adts_Length_CrcCheck) {
goto bail;
}
crc_check = FDKreadBits(hBs, Adts_Length_CrcCheck); crc_check = FDKreadBits(hBs, Adts_Length_CrcCheck);
adtsHeaderLength += Adts_Length_CrcCheck; adtsHeaderLength += Adts_Length_CrcCheck;
@ -343,6 +359,10 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
FDKmemcpy(&pAdts->bs, &bs, sizeof(STRUCT_ADTS_BS)); FDKmemcpy(&pAdts->bs, &bs, sizeof(STRUCT_ADTS_BS));
return TRANSPORTDEC_OK; return TRANSPORTDEC_OK;
bail:
FDKpushBack(hBs, adtsHeaderLength);
return TRANSPORTDEC_NOT_ENOUGH_BITS;
} }
int adtsRead_GetRawDataBlockLength(HANDLE_ADTS pAdts, INT blockNum) { int adtsRead_GetRawDataBlockLength(HANDLE_ADTS pAdts, INT blockNum) {