fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-02-16 19:30:34 +01:00
Code Issues Projects Releases Wiki Activity

Make sure to end all CRC regions in the right order

Browse Source 
This fixes assert failures, when a (corrupt/fuzzed) bitstream
doesn't trigger starting/ending CRCs properly (or when decoding
is aborted halfway when an error is encountered). Skipping ending
a CRC region doesn't trigger an assert failure, but when a later
CRC region is started and ended, an assert fails when the end
doesn't match the expected CRC region.

Fixes: 1928/clusterfuzz-testcase-minimized-6480505958563840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
This commit is contained in:
Martin Storsjo 2017-06-11 22:59:38 +03:00
parent 21cb19455c
commit d2fa9750d5
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libAACdec/src/channel.cpp
View File

@ -411,11 +411,15 @@ AAC_DECODER_ERROR CChannelElement_Read(HANDLE_FDK_BITSTREAM hBs,
case drmcrc_end_reg:
if (pTpDec != NULL) {
transportDec_CrcEndReg(pTpDec, crcReg1);
crcReg1 = -1;
}
break;
case adtscrc_end_reg2:
if (pTpDec != NULL) {
if (crcReg1 != -1) {
error = AAC_DEC_DECODE_FRAME_ERROR;
} else if (pTpDec != NULL) {
transportDec_CrcEndReg(pTpDec, crcReg2);
crcReg2 = -1;
}
break;
case drmcrc_start_reg:
@ -447,5 +451,16 @@ AAC_DECODER_ERROR CChannelElement_Read(HANDLE_FDK_BITSTREAM hBs,
} while (list->id[i] != end_of_sequence);
bail:
if (crcReg1 != -1 || crcReg2 != -1) {
if (error == AAC_DEC_OK) {
error = AAC_DEC_DECODE_FRAME_ERROR;
}
if (crcReg1 != -1) {
transportDec_CrcEndReg(pTpDec, crcReg1);
}
if (crcReg2 != -1) {
transportDec_CrcEndReg(pTpDec, crcReg2);
}
}
return error;
}