From 71602ad45c131d431b40f659aa3f5ea2ea5883eb Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 8 Jun 2018 18:16:29 +0200
Subject: [PATCH] Unsigned Integer Overflow in
 transportDec_AdjustEndOfAccessUnit().

Bug: 112661348
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Ie4924460d30ea4ef76917704ded809d04db78993
---
 libMpegTPDec/src/tpdec_lib.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp
index 1d8b7b3..cee0768 100644
--- a/libMpegTPDec/src/tpdec_lib.cpp
+++ b/libMpegTPDec/src/tpdec_lib.cpp
@@ -736,9 +736,9 @@ static TRANSPORTDEC_ERROR transportDec_AdjustEndOfAccessUnit(
             hTp->parser.latm.m_audioMuxLengthBytes > 0) {
           int loasOffset;
 
-          loasOffset = (hTp->parser.latm.m_audioMuxLengthBytes * 8 +
-                        FDKgetValidBits(hBs)) -
-                       hTp->globalFramePos;
+          loasOffset = ((INT)hTp->parser.latm.m_audioMuxLengthBytes * 8 +
+                        (INT)FDKgetValidBits(hBs)) -
+                       (INT)hTp->globalFramePos;
           if (loasOffset != 0) {
             FDKpushBiDirectional(hBs, loasOffset);
             /* For ELD and other payloads there is an unknown amount of padding,