fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Avoid unsigned integer overflows in FDK_Feed(). 

Bug: 146937030
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I7bd63c2fbfed2612c80d3334d1339e1cd215e034
This commit is contained in:
Fraunhofer IIS FDK 2019-11-13 16:08:09 +01:00 committed by Jean-Michel Trivi
parent 8fee7605df
commit e3b9058b8b
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libFDK/src/FDK_bitbuffer.cpp
View File

@ -1,7 +1,7 @@
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten © Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved. Forschung e.V. All rights reserved.
1. INTRODUCTION 1. INTRODUCTION
@ -368,7 +368,10 @@ void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer,
UINT bTotal = 0; UINT bTotal = 0;
UINT bToRead = (hBitBuf->bufBits - hBitBuf->ValidBits) >> 3; UINT bToRead =
fMin(hBitBuf->bufBits,
(UINT)fMax(0, ((INT)hBitBuf->bufBits - (INT)hBitBuf->ValidBits))) >>
3;
UINT noOfBytes = UINT noOfBytes =
fMin(bToRead, fMin(bToRead,
*bytesValid); //(bToRead < *bytesValid) ? bToRead : *bytesValid ; *bytesValid); //(bToRead < *bytesValid) ? bToRead : *bytesValid ;
@ -384,7 +387,7 @@ void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer,
bToRead * sizeof(UCHAR)); bToRead * sizeof(UCHAR));
/* add noOfBits to number of valid bits in buffer */ /* add noOfBits to number of valid bits in buffer */
hBitBuf->ValidBits += bToRead << 3; hBitBuf->ValidBits = (UINT)((INT)hBitBuf->ValidBits + (INT)(bToRead << 3));
bTotal += bToRead; bTotal += bToRead;
inputBuffer += bToRead; inputBuffer += bToRead;