fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Unsigned Integer Overflow in transportDec_readHeader(). 

Bug: 112662270
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I0beedab38175fc57e5bd9eb5700a3850ef2bebf7
This commit is contained in:
Fraunhofer IIS FDK 2018-06-08 18:18:14 +02:00 committed by Jean-Michel Trivi
parent c75797cfaa
commit 81933bc6eb
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libMpegTPDec/src/tpdec_lib.cpp
View File

@ -871,7 +871,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0;
int startPos;
startPos = FDKgetValidBits(hBs);
startPos = (INT)FDKgetValidBits(hBs);
switch (hTp->transportFmt) {
case TT_MP4_ADTS:
@ -941,7 +941,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
fTraverseMoreFrames = 0;
}
syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) -
((INT)startPos - (INT)FDKgetValidBits(hBs)) -
(startPos - (INT)FDKgetValidBits(hBs)) -
syncLength;
if (syncLayerFrameBits <= 0) {
err = TRANSPORTDEC_SYNC_ERROR;
@ -952,7 +952,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
break;
case TT_MP4_LOAS:
if (hTp->numberOfRawDataBlocks <= 0) {
syncLayerFrameBits = FDKreadBits(hBs, 13);
syncLayerFrameBits = (INT)FDKreadBits(hBs, 13);
hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits;
syncLayerFrameBits <<= 3;
}
@ -974,7 +974,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
hTp->numberOfRawDataBlocks =
CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm);
if (hTp->transportFmt == TT_MP4_LOAS) {
syncLayerFrameBits -= startPos - FDKgetValidBits(hBs) - (13);
syncLayerFrameBits -= startPos - (INT)FDKgetValidBits(hBs) - (13);
}
}
} else {