fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). am: bb8f983bf3 am: f007f6a4bc 

Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/12087395

Change-Id: I28c773eab019d0e518d34a26a9493811c8c1afea
This commit is contained in:
Fraunhofer IIS FDK 2020-09-09 21:37:22 +00:00 committed by Automerger Merge Worker
parent 016718d3fd f007f6a4bc
commit a5a3ef611c
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libSBRdec/src/sbrdecoder.cpp
View File

@ -1,7 +1,7 @@
/* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved.
1. INTRODUCTION
@ -617,10 +617,6 @@ SBR_ERROR sbrDecoder_InitElement(
self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels;
}
/* Save element ID for sanity checks and to have a fallback for concealment.
*/
self->pSbrElement[elementIndex]->elementID = elementID;
/* Determine amount of channels for this element */
switch (elementID) {
case ID_NONE:
@ -653,12 +649,16 @@ SBR_ERROR sbrDecoder_InitElement(
}
/* Sanity check to avoid memory leaks */
if (elChannels < self->pSbrElement[elementIndex]->nChannels) {
if (elChannels < self->pSbrElement[elementIndex]->nChannels ||
(self->numSbrChannels + elChannels) > (8) + (1)) {
self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels;
sbrError = SBRDEC_PARSE_ERROR;
goto bail;
}
/* Save element ID for sanity checks and to have a fallback for concealment.
*/
self->pSbrElement[elementIndex]->elementID = elementID;
self->pSbrElement[elementIndex]->nChannels = elChannels;
for (ch = 0; ch < elChannels; ch++) {