fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-02-12 01:20:38 +01:00
Code Issues Projects Releases Wiki Activity

Fix out of bound memory access in lppTransposer

Browse Source 
In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a
  reasonable value to guarantee correct termination in while loop
  in lppTransposer function. This fixes the reported bug.
For completeness:
  - clear the whole bwIndex array instead of noOfPatches entries only.
  - abort criterion in while loop to prevent potential
    infinite loop, and limit bwIndex[patch] to a valid range.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65280786

Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
This commit is contained in:
Jean-Michel Trivi 2017-10-30 11:31:03 -07:00
parent 78653b30e9
commit 6d3dd40e20
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libSBRdec/src/lpp_tran.cpp
View File

@ -293,7 +293,7 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transp
}
/* init bwIndex for each patch */
FDKmemclear(bwIndex, pSettings->noOfPatches*sizeof(INT));
FDKmemclear(bwIndex, MAX_NUM_PATCHES*sizeof(INT));
/*
Calc common low band scale factor
@ -621,9 +621,9 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transp
FDK_ASSERT( hiBand < (64) );
/* bwIndex[patch] is already initialized with value from previous band inside this patch */
while (hiBand >= pSettings->bwBorders[bwIndex[patch]])
while (hiBand >= pSettings->bwBorders[bwIndex[patch]] && bwIndex[patch] < MAX_NUM_PATCHES-1) {
bwIndex[patch]++;
}
/*
Filter Step 2: add the left slope with the current filter to the buffer
@ -962,6 +962,10 @@ resetLppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transpos
for(i = 0 ; i < noNoiseBands; i++){
pSettings->bwBorders[i] = noiseBandTable[i+1];
}
for (;i < MAX_NUM_NOISE_VALUES; i++) {
pSettings->bwBorders[i] = 255;
}
/*
* Choose whitening factors