fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

DO NOT MERGE Prevent out of bound memory access in GetInvInt 

In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048

Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
This commit is contained in:
Jean-Michel Trivi 2017-10-30 14:07:07 -07:00
parent 78653b30e9
commit 76c4625fe3
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libFDK/include/fixpoint_math.h
View File

@ -450,15 +450,19 @@ inline FIXP_DBL fAddSaturate(const FIXP_DBL a, const FIXP_DBL b)
/**
* \brief Calculate the value of 1/i where i is a integer value. It supports
* input values from 1 upto 50.
* input values from 0 upto 49.
* \param intValue Integer input value.
* \param FIXP_DBL representation of 1/intValue
*/
inline FIXP_DBL GetInvInt(int intValue)
{
FDK_ASSERT((intValue > 0) && (intValue < 50));
FDK_ASSERT(intValue<50);
return invCount[intValue];
FDK_ASSERT((intValue >= 0) && (intValue < 50));
if (intValue < 0)
return invCount[0];
else if (intValue > 49)
return invCount[49];
else
return invCount[intValue];
}