From a7c64ff42f1c67960acb9686555ecbc683e3762c Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Thu, 9 Apr 2020 17:54:50 +0200
Subject: [PATCH] Fix unsigned integer overflow in
 Hcr_State_BODY_SIGN_ESC__ESC_WORD().

Bug: 176246647
Test: atest DecoderTestXheAac DecoderTestAacDrc
Change-Id: I5eb0f88a55e856c427f9e4647332070f66e673c5
---
 libAACdec/src/aacdec_hcrs.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp
index 44b32a5..5e3f9ac 100644
--- a/libAACdec/src/aacdec_hcrs.cpp
+++ b/libAACdec/src/aacdec_hcrs.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -173,7 +173,9 @@ void DecodeNonPCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) {
     pHcr->segmentInfo.readDirection = FROM_RIGHT_TO_LEFT;
 
     /* Process sets subsequently */
+    numSet = fMin(numSet, (UCHAR)MAX_HCR_SETS);
     for (currentSet = 1; currentSet < numSet; currentSet++) {
+
       /* step 1 */
       numCodeword -=
           *pNumSegment; /* number of remaining non PCWs [for all sets] */