fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
1,019 Commits 10 Branches 11 Tags 11 MiB
Commit Graph

1019 Commits

Author SHA1 Message Date
Jean-Michel Trivi 06c27a9feb Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e 
am: 6e15baff97

Change-Id: Ic11d63d594dabfb8359d19eb36f9bdcc56abd2ac
 2017-11-03 19:19:22 +00:00
Jean-Michel Trivi 724b40ccce DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 
am: d157498711  -s ours

Change-Id: Ica332afb180137b27845c06d35108928102826f6
 2017-11-03 19:19:04 +00:00
Jean-Michel Trivi 73d49a121c DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743 am: 3e28ad2039 
am: d948041971

Change-Id: I078057af435ad081e8f55574c03706b8e73405e4
 2017-11-03 19:17:58 +00:00
Jean-Michel Trivi 75fe8cb95e Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 
am: 022a305d55

Change-Id: I15f8ada5cbf90deefb7e9d2221a58a3b8f8dd038
 2017-11-03 19:17:35 +00:00
Jean-Michel Trivi bceba8dd97 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 3b6a14a1e0 
am: a1deac7b1a

Change-Id: Icdb0255365260129f6c1ce8cb8a323d87015cf87
 2017-11-03 19:17:35 +00:00
Jean-Michel Trivi 14713b88c7 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 0d54662fe8 -s ours 
am: 139ba15904

Change-Id: I7a777c6727e583ea52008aad6da40db3b7151732
 2017-11-03 19:17:34 +00:00
Jean-Michel Trivi 6e15baff97 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 
am: d8e897ae9e

Change-Id: Id2b60900e4abe08d2f1c1612e7c729c75f2e61c0
 2017-11-03 19:16:22 +00:00
Jean-Michel Trivi 022a305d55 Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 
am: c0719825a2

Change-Id: I526341d43af40089117110cfff2f41586121e5ff
 2017-11-03 19:16:06 +00:00
Jean-Michel Trivi d948041971 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743 
am: 3e28ad2039

Change-Id: I410dc4905aaa0cceeb40d4a6d7ef5072c93ee6ae
 2017-11-03 19:16:06 +00:00
Jean-Michel Trivi 272ae57aa8 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 
am: 96fbbc31db  -s ours

Change-Id: Icab41a4c796ad9f31128dd8289ea4839d5823605
 2017-11-03 19:16:05 +00:00
Jean-Michel Trivi d157498711 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 
am: 2bebb8fb65

Change-Id: I4645d168431438e8bfbfc28514f21aad015633ac
 2017-11-03 19:16:05 +00:00
Jean-Michel Trivi c0719825a2 Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours 
am: e1d517a909

Change-Id: Id97f3b0f0b59445fe85ab7c957e84d6be65f565b
 2017-11-03 19:14:05 +00:00
Jean-Michel Trivi 3e28ad2039 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d 
am: 5285345743

Change-Id: Ia99bbf37644c24b32d967e6736b913da605f2d12
 2017-11-03 19:14:05 +00:00
Jean-Michel Trivi 4d9b54962d DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 5ce724f1dd 
am: e64c501013

Change-Id: I08487bbe7415689ac5976b73e10b6caae8b48e15
 2017-11-03 19:14:05 +00:00
Jean-Michel Trivi 23ee0f0ee2 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 9fb4261c43 
am: f6100335b8  -s ours

Change-Id: Iad0be22f13e2bc9f126edb5abea37b0446ea6e68
 2017-11-03 19:14:04 +00:00
Jean-Michel Trivi 139ba15904 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: 0d54662fe8  -s ours

Change-Id: I192e79af896606e8d5d17f63e0883f2069be1a12
 2017-11-03 19:14:04 +00:00
Jean-Michel Trivi d8e897ae9e Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 
am: fca1027937

Change-Id: I8803d858a432aea8fba8b7ec29ba28458e7418d8
 2017-11-03 19:13:45 +00:00
Jean-Michel Trivi a1deac7b1a DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: 3b6a14a1e0

Change-Id: Id527e5320a362042ef0c65329082a369687e9db7
 2017-11-03 19:13:34 +00:00
Jean-Michel Trivi 96fbbc31db DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 
am: 6fac7101c6

Change-Id: If3c68bd6341d7c9eff5257ec41ca6c1a2161077c
 2017-11-03 19:13:34 +00:00
Jean-Michel Trivi 2bebb8fb65 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b 
am: 7462464e43

Change-Id: I064298bc197e53e6f5a6ce1872cb77c9444d8dee
 2017-11-03 19:13:34 +00:00
Jean-Michel Trivi e1d517a909 Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev 
am: 5565e7791f  -s ours

Change-Id: I30f8ee01f8a715cabf8edb10edf15bad032f5001
 2017-11-03 19:10:33 +00:00
Jean-Michel Trivi 5285345743 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: 51f38b3a6d

Change-Id: I01d4479fd2194e85b77b11d678facb7f581ff517
 2017-11-03 19:10:33 +00:00
Jean-Michel Trivi fca1027937 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 
am: 2a7b438754

Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
 2017-11-03 19:10:25 +00:00
Jean-Michel Trivi f6100335b8 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: 9fb4261c43

Change-Id: If0378d7935b9f651f7096eee8916d4f83889a629
 2017-11-03 19:10:04 +00:00
Jean-Michel Trivi e64c501013 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: 5ce724f1dd

Change-Id: I3b88b500ce26106a277ce6604c6d513bac4a7085
 2017-11-03 19:10:04 +00:00
Jean-Michel Trivi 6fac7101c6 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: 070e7b81c0

Change-Id: Ibcddd5c0e53aaae0d26e1c33c6e42bc7268cf6a1
 2017-11-03 19:10:04 +00:00
Jean-Michel Trivi 7462464e43 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
am: d0e8397b7b

Change-Id: If35860a327395c578e6f02b3706db0fd041e719e
 2017-11-03 19:10:04 +00:00
Jean-Michel Trivi 2a7b438754 Fix out of bound memory access in lppTransposer 
am: 6d3dd40e20

Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
 2017-11-03 19:07:04 +00:00
TreeHugger Robot 5565e7791f Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev 2017-11-03 19:05:37 +00:00
Jean-Michel Trivi 9fb4261c43 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
 2017-11-02 19:18:56 +00:00
Jean-Michel Trivi 5ce724f1dd DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
 2017-11-02 18:55:37 +00:00
Jean-Michel Trivi 0d54662fe8 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
 2017-11-02 18:54:15 +00:00
Jean-Michel Trivi 3b6a14a1e0 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
 2017-11-02 18:52:41 +00:00
Jean-Michel Trivi 51f38b3a6d DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
 2017-11-02 16:25:34 +00:00
Jean-Michel Trivi 6d3dd40e20 Fix out of bound memory access in lppTransposer 
In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a
  reasonable value to guarantee correct termination in while loop
  in lppTransposer function. This fixes the reported bug.
For completeness:
  - clear the whole bwIndex array instead of noOfPatches entries only.
  - abort criterion in while loop to prevent potential
    infinite loop, and limit bwIndex[patch] to a valid range.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65280786

Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
 2017-10-31 21:40:14 +00:00
Jean-Michel Trivi 070e7b81c0 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
 2017-10-30 22:46:18 +00:00
Jean-Michel Trivi 76c4625fe3 DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048

Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
 2017-10-30 22:45:05 +00:00
Jean-Michel Trivi d0e8397b7b DO NOT MERGE Prevent out of bound memory access in GetInvInt 
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
 2017-10-30 15:20:44 -07:00
Martin Storsjo 1e3515e03e Fix an assertion failure (avoid division by zero) when encoding a particular input 2017-10-30 23:06:44 +02:00
Martin Storsjo cf697df5ad Avoid reading out of bounds due to negative aaIccIndexMapped 
Fixes: 3452/clusterfuzz-testcase-4898065225875456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
 2017-10-20 16:33:25 +03:00
Martin Storsjo c366b3db8f Add tighter sanity checks in CBlock_GetEscape 
We can't read 31 bits of value here, since that would place the
topmost bit in the sign bit.

Fixes: 3480/clusterfuzz-testcase-4573445423628288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
 2017-10-20 16:33:25 +03:00
android-build-team Robot f7d8e3e2d7 Snap for 4383207 from 15759ceb7b to pi-release 
Change-Id: I0c9541a967456c23dd621965cd7e8b9edd39ff85
 2017-10-07 08:00:24 +00:00
Chih-Hung Hsieh 15759ceb7b Merge "Use -Werror in external/aac" am: f38aee2252 am: 82440fab16 am: 5a1868a64f 
am: 858c2a7c6e

Change-Id: I34b525da95c712354d0e4c4d72f7d7ef89ff2ba9
 2017-10-07 00:55:09 +00:00
Chih-Hung Hsieh 858c2a7c6e Merge "Use -Werror in external/aac" am: f38aee2252 am: 82440fab16 
am: 5a1868a64f

Change-Id: I4beb4b05f00077e1c7cbcc5ae197001c6251af09
 2017-10-07 00:50:14 +00:00
Chih-Hung Hsieh 5a1868a64f Merge "Use -Werror in external/aac" am: f38aee2252 
am: 82440fab16

Change-Id: I3cee76ab540b54b4ef6d6bdb891fc53fd0ec562d
 2017-10-07 00:47:44 +00:00
Chih-Hung Hsieh 82440fab16 Merge "Use -Werror in external/aac" 
am: f38aee2252

Change-Id: I65c18c6eb45de16da43e862068929e9a9695caf7
 2017-10-07 00:45:22 +00:00
Treehugger Robot f38aee2252 Merge "Use -Werror in external/aac" 2017-10-07 00:39:23 +00:00
Chih-Hung Hsieh 3e8a17c1c1 Use -Werror in external/aac 
Bug: 66996870
Test: build with WITH_TIDY=1
Exempt-From-Owner-Approval: Colin +2 should be the owner approval
Change-Id: I167f73ee9dc5e977fd6976f48732ae1e1fe13c8b
 2017-10-06 21:52:25 +00:00
Doug Benedict e2e35b8273 Make sure there are enough bits when reading ADTS header. 2017-09-20 14:30:42 -07:00
Martin Storsjo a3d1168943 Adjust the fix for infinite loops with a drained ADTS stream 
This should have less risk of causing other issues.
 2017-08-18 22:38:09 +03:00