From f451278f0e57a7355783d644f7083b28b41e4b4e Mon Sep 17 00:00:00 2001 From: Jean-Michel Trivi Date: Mon, 5 Oct 2020 16:27:56 -0700 Subject: [PATCH] Fix fuzzer's use of aacDecoder_DecodeFrame The aacDecoder_DecodeFrame function takes a size in numbers of samples (INT_PCM), not a number of bytes. Using a number of bytes caused the FDK to believe the array was larger than it really was. Therefore on invalid frames, it would try to clear a size larger than was really available, causing an OOB crash. Bug: 161014225 Test: check clusterfuzz results for case 6217304556437504 Change-Id: I9278898a17c1c961c568e841c6037d0c14bcc8b4 --- fuzzer/aac_dec_fuzzer.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fuzzer/aac_dec_fuzzer.cpp b/fuzzer/aac_dec_fuzzer.cpp index b5545fc..c970197 100644 --- a/fuzzer/aac_dec_fuzzer.cpp +++ b/fuzzer/aac_dec_fuzzer.cpp @@ -118,7 +118,8 @@ void Codec::decodeFrames(UCHAR *data, UINT size) { INT_PCM outputBuf[kMaxOutBufferSize]; do { mErrorCode = - aacDecoder_DecodeFrame(mAacDecoderHandle, outputBuf, sizeof(outputBuf), 0); + aacDecoder_DecodeFrame(mAacDecoderHandle, outputBuf, + kMaxOutBufferSize /*size in number of INT_PCM, not bytes*/, 0); } while (mErrorCode == AAC_DEC_OK); UINT offset = inputSize - valid; data += offset;