From bfa96f60bc607f64f865c9a77b8d896f8250e3b8 Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 8 Jun 2018 18:15:03 +0200
Subject: [PATCH] Unsigned Integer Overflows in mpegSurroundDecoder_Parse().

Bug: 112661835
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I3714e88d7a9a866297bb2e93571804665a97773f
---
 libSACdec/src/sac_dec_lib.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp
index ebf9bee..5ae89d1 100644
--- a/libSACdec/src/sac_dec_lib.cpp
+++ b/libSACdec/src/sac_dec_lib.cpp
@@ -1232,7 +1232,7 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder,
 
   FDK_ASSERT(pMpegSurroundDecoder->pSpatialDec);
 
-  mpsBsBits = FDKgetValidBits(hBs);
+  mpsBsBits = (INT)FDKgetValidBits(hBs);
 
   sscParse = &pMpegSurroundDecoder
                   ->spatialSpecificConfig[pMpegSurroundDecoder->bsFrameParse];
@@ -1308,14 +1308,14 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder,
                   pMpegSurroundDecoder->spatialSpecificConfigBackup;
 
               /* Parse spatial specific config */
-              bitsRead = FDKgetValidBits(hMpsBsData);
+              bitsRead = (INT)FDKgetValidBits(hMpsBsData);
 
               err = SpatialDecParseSpecificConfigHeader(
                   hMpsBsData,
                   &pMpegSurroundDecoder->spatialSpecificConfigBackup, coreCodec,
                   pMpegSurroundDecoder->upmixType);
 
-              bitsRead = (bitsRead - FDKgetValidBits(hMpsBsData));
+              bitsRead = (bitsRead - (INT)FDKgetValidBits(hMpsBsData));
               parseResult = ((err == MPS_OK) ? bitsRead : -bitsRead);
 
               if (parseResult < 0) {
@@ -1429,7 +1429,7 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder,
 
 bail:
 
-  *pMpsDataBits -= (mpsBsBits - FDKgetValidBits(hBs));
+  *pMpsDataBits -= (mpsBsBits - (INT)FDKgetValidBits(hBs));
 
   return err;
 }