fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Don't use an enum for a value read directly from the bitstream 

The enum doesn't cover all possible values read from the bitstream.

This fixes undefined behaviour sanitizer errors.

Fixes: 20376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBFDK_AAC_fuzzer-4785514974806016.dms

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
This commit is contained in:
Martin Storsjo 2020-02-01 22:13:18 +02:00
parent d47c2c6259
commit e7d8591ff2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libMpegTPDec/src/tpdec_asc.cpp
View File

@ -1628,14 +1628,14 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc,
TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK; TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
int numConfigExtensions; int numConfigExtensions;
CONFIG_EXT_ID usacConfigExtType; int usacConfigExtType;
int usacConfigExtLength; int usacConfigExtLength;
numConfigExtensions = (int)escapedValue(hBs, 2, 4, 8) + 1; numConfigExtensions = (int)escapedValue(hBs, 2, 4, 8) + 1;
for (int confExtIdx = 0; confExtIdx < numConfigExtensions; confExtIdx++) { for (int confExtIdx = 0; confExtIdx < numConfigExtensions; confExtIdx++) {
INT nbits; INT nbits;
int loudnessInfoSetConfigExtensionPosition = FDKgetValidBits(hBs); int loudnessInfoSetConfigExtensionPosition = FDKgetValidBits(hBs);
usacConfigExtType = (CONFIG_EXT_ID)escapedValue(hBs, 4, 8, 16); usacConfigExtType = escapedValue(hBs, 4, 8, 16);
usacConfigExtLength = (int)escapedValue(hBs, 4, 8, 16); usacConfigExtLength = (int)escapedValue(hBs, 4, 8, 16);
/* Start bit position of config extension */ /* Start bit position of config extension */