fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-06-05 22:39:13 +02:00
Code Issues Projects Releases Wiki Activity

Merge "Unsigned Integer Overflow in transportDec_readHeader()." am: 93e981d1e1

Browse Source 
am: 11e6511470

Change-Id: I2e93dbf3792b0039d36d882e66007cf251fc15ff
This commit is contained in:
Jean-Michel Trivi
2018-12-26 15:05:37 -08:00
committed by android-build-merger
parent b7f477ae47 11e6511470
commit 7912e0dffc
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libMpegTPDec/src/tpdec_lib.cpp
View File

@@ -871,7 +871,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0; int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0;
int startPos; int startPos;
startPos = FDKgetValidBits(hBs); startPos = (INT)FDKgetValidBits(hBs);
switch (hTp->transportFmt) { switch (hTp->transportFmt) {
case TT_MP4_ADTS: case TT_MP4_ADTS:
@@ -941,7 +941,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
fTraverseMoreFrames = 0; fTraverseMoreFrames = 0;
} }
syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) - syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) -
((INT)startPos - (INT)FDKgetValidBits(hBs)) - (startPos - (INT)FDKgetValidBits(hBs)) -
syncLength; syncLength;
if (syncLayerFrameBits <= 0) { if (syncLayerFrameBits <= 0) {
err = TRANSPORTDEC_SYNC_ERROR; err = TRANSPORTDEC_SYNC_ERROR;
@@ -952,7 +952,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
break; break;
case TT_MP4_LOAS: case TT_MP4_LOAS:
if (hTp->numberOfRawDataBlocks <= 0) { if (hTp->numberOfRawDataBlocks <= 0) {
syncLayerFrameBits = FDKreadBits(hBs, 13); syncLayerFrameBits = (INT)FDKreadBits(hBs, 13);
hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits; hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits;
syncLayerFrameBits <<= 3; syncLayerFrameBits <<= 3;
} }
@@ -974,7 +974,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
hTp->numberOfRawDataBlocks = hTp->numberOfRawDataBlocks =
CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm); CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm);
if (hTp->transportFmt == TT_MP4_LOAS) { if (hTp->transportFmt == TT_MP4_LOAS) {
syncLayerFrameBits -= startPos - FDKgetValidBits(hBs) - (13); syncLayerFrameBits -= startPos - (INT)FDKgetValidBits(hBs) - (13);
} }
} }
} else { } else {