1
0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-02-02 00:46:43 +01:00

241 Commits

Author SHA1 Message Date
Jean-Michel Trivi
60c9a6e4c7 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27
am: 117691fe59

Change-Id: I28274f0fce7de6992f0c60c000bbecb0f21a3535
2017-11-03 19:39:35 +00:00
Jean-Michel Trivi
0a9273a678 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb am: 083f093d1b -s ours
am: 7517e7cd48

Change-Id: I50823ae367196b85d815b3ed1c6ac1b4c80cdae5
2017-11-03 19:39:22 +00:00
Jean-Michel Trivi
cb0e7b4d19 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 am: a8eba4b634 am: c7048181c0 am: 849c9b161a am: e8c8539070 -s ours
am: 6f71724cd7

Change-Id: I02e875f665ed4f7464b59000a4fdee096f71ddf7
2017-11-03 19:39:07 +00:00
Jean-Michel Trivi
117691fe59 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6
am: 5a2ae5cc27

Change-Id: Id4cceec7b64a1281bb922b76471f1bad7f283497
2017-11-03 19:36:01 +00:00
Jean-Michel Trivi
7517e7cd48 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb
am: 083f093d1b  -s ours

Change-Id: I9f6da4a5c1377badab19374ef20ce7afde3321a2
2017-11-03 19:35:48 +00:00
Jean-Michel Trivi
6f71724cd7 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 am: a8eba4b634 am: c7048181c0 am: 849c9b161a
am: e8c8539070  -s ours

Change-Id: Idafc9e6351b9590bda06fca836540efb4fb45246
2017-11-03 19:35:36 +00:00
Jean-Michel Trivi
5a2ae5cc27 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99
am: 77aac03fb6

Change-Id: I513fd4f92c93ece5fae4bc4db29eb442e951be92
2017-11-03 19:33:03 +00:00
Jean-Michel Trivi
083f093d1b DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c
am: a9a123b2fb

Change-Id: I11f93ad48d89bef4647b9d7c081660765330d78c
2017-11-03 19:32:52 +00:00
Jean-Michel Trivi
e8c8539070 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 am: a8eba4b634 am: c7048181c0
am: 849c9b161a

Change-Id: I2b195f437bad5f77e48f6f8dce56542633f7d30b
2017-11-03 19:32:37 +00:00
Jean-Michel Trivi
77aac03fb6 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380
am: 902decfc99

Change-Id: I04632c3154dddc9c6b7b80d4f3393dc20194dd27
2017-11-03 19:28:41 +00:00
Jean-Michel Trivi
a9a123b2fb DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17
am: 0c25940e1c

Change-Id: I599488f38c5b080533988d48edc0ee1df80c9da9
2017-11-03 19:28:29 +00:00
Jean-Michel Trivi
849c9b161a DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 am: a8eba4b634
am: c7048181c0

Change-Id: I7d1de9b9cf9e03a03d27b5f5fd89eb08ff12f280
2017-11-03 19:28:08 +00:00
Jean-Michel Trivi
902decfc99 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb
am: e6b649a380

Change-Id: I54610df83d3e84021bd71e81c2f910545908c986
2017-11-03 19:25:27 +00:00
Jean-Michel Trivi
0c25940e1c DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce
am: 67a321cd17

Change-Id: I07c673dbbdab32f515bbefb52bd4495c83664ccf
2017-11-03 19:25:17 +00:00
Jean-Michel Trivi
c7048181c0 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8
am: a8eba4b634

Change-Id: I7c719af7670774f2db0f01d8a97199d4b3889be4
2017-11-03 19:25:05 +00:00
Jean-Michel Trivi
0f6d9ce9fc DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743 am: 3e28ad2039 am: d948041971 am: 73d49a121c -s ours
am: b9d122614f

Change-Id: Icdde9de7c30b7f151bed424807ff436980d65e53
2017-11-03 19:24:14 +00:00
Jean-Michel Trivi
c4c35bf021 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 3b6a14a1e0 am: a1deac7b1a am: bceba8dd97 -s ours
am: 7f986a4b77

Change-Id: I51c9e1f99d9d22933c479460364ab204c79e167e
2017-11-03 19:23:35 +00:00
Jean-Michel Trivi
e6b649a380 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97
am: 06c27a9feb

Change-Id: Id5bfc33a815aec69a302b5ba1460ad2d556c9179
2017-11-03 19:21:31 +00:00
Jean-Michel Trivi
b9d122614f DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743 am: 3e28ad2039 am: d948041971
am: 73d49a121c  -s ours

Change-Id: I06a83a28b5a843bcd7865edc8f148b6fb1b0f649
2017-11-03 19:21:19 +00:00
Jean-Michel Trivi
67a321cd17 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours
am: 724b40ccce

Change-Id: Ia566e7de7c215e77bd6d6f0f1f069a855b9edc02
2017-11-03 19:21:18 +00:00
Jean-Michel Trivi
a8eba4b634 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours
am: 272ae57aa8

Change-Id: Id7da9dba87a2951901e0732e666cd84b1e6d573e
2017-11-03 19:21:05 +00:00
Jean-Michel Trivi
7f986a4b77 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 3b6a14a1e0 am: a1deac7b1a
am: bceba8dd97  -s ours

Change-Id: I1c7b0d98c7dc985852863c3466ad98df394c750e
2017-11-03 19:21:04 +00:00
Jean-Michel Trivi
06c27a9feb Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e
am: 6e15baff97

Change-Id: Ic11d63d594dabfb8359d19eb36f9bdcc56abd2ac
2017-11-03 19:19:22 +00:00
Jean-Michel Trivi
724b40ccce DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65
am: d157498711  -s ours

Change-Id: Ica332afb180137b27845c06d35108928102826f6
2017-11-03 19:19:04 +00:00
Jean-Michel Trivi
73d49a121c DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743 am: 3e28ad2039
am: d948041971

Change-Id: I078057af435ad081e8f55574c03706b8e73405e4
2017-11-03 19:17:58 +00:00
Jean-Michel Trivi
bceba8dd97 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 3b6a14a1e0
am: a1deac7b1a

Change-Id: Icdb0255365260129f6c1ce8cb8a323d87015cf87
2017-11-03 19:17:35 +00:00
Jean-Michel Trivi
14713b88c7 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 0d54662fe8 -s ours
am: 139ba15904

Change-Id: I7a777c6727e583ea52008aad6da40db3b7151732
2017-11-03 19:17:34 +00:00
Jean-Michel Trivi
6e15baff97 Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937
am: d8e897ae9e

Change-Id: Id2b60900e4abe08d2f1c1612e7c729c75f2e61c0
2017-11-03 19:16:22 +00:00
Jean-Michel Trivi
d948041971 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743
am: 3e28ad2039

Change-Id: I410dc4905aaa0cceeb40d4a6d7ef5072c93ee6ae
2017-11-03 19:16:06 +00:00
Jean-Michel Trivi
272ae57aa8 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6
am: 96fbbc31db  -s ours

Change-Id: Icab41a4c796ad9f31128dd8289ea4839d5823605
2017-11-03 19:16:05 +00:00
Jean-Michel Trivi
d157498711 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43
am: 2bebb8fb65

Change-Id: I4645d168431438e8bfbfc28514f21aad015633ac
2017-11-03 19:16:05 +00:00
Jean-Michel Trivi
3e28ad2039 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d
am: 5285345743

Change-Id: Ia99bbf37644c24b32d967e6736b913da605f2d12
2017-11-03 19:14:05 +00:00
Jean-Michel Trivi
139ba15904 DO NOT MERGE Prevent out of bound memory access in GetInvInt
am: 0d54662fe8  -s ours

Change-Id: I192e79af896606e8d5d17f63e0883f2069be1a12
2017-11-03 19:14:04 +00:00
Jean-Michel Trivi
d8e897ae9e Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754
am: fca1027937

Change-Id: I8803d858a432aea8fba8b7ec29ba28458e7418d8
2017-11-03 19:13:45 +00:00
Jean-Michel Trivi
a1deac7b1a DO NOT MERGE Prevent out of bound memory access in GetInvInt
am: 3b6a14a1e0

Change-Id: Id527e5320a362042ef0c65329082a369687e9db7
2017-11-03 19:13:34 +00:00
Jean-Michel Trivi
96fbbc31db DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0
am: 6fac7101c6

Change-Id: If3c68bd6341d7c9eff5257ec41ca6c1a2161077c
2017-11-03 19:13:34 +00:00
Jean-Michel Trivi
2bebb8fb65 DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b
am: 7462464e43

Change-Id: I064298bc197e53e6f5a6ce1872cb77c9444d8dee
2017-11-03 19:13:34 +00:00
Jean-Michel Trivi
5285345743 DO NOT MERGE Prevent out of bound memory access in GetInvInt
am: 51f38b3a6d

Change-Id: I01d4479fd2194e85b77b11d678facb7f581ff517
2017-11-03 19:10:33 +00:00
Jean-Michel Trivi
fca1027937 Fix out of bound memory access in lppTransposer am: 6d3dd40e20
am: 2a7b438754

Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
2017-11-03 19:10:25 +00:00
Jean-Michel Trivi
e64c501013 DO NOT MERGE Prevent out of bound memory access in GetInvInt
am: 5ce724f1dd

Change-Id: I3b88b500ce26106a277ce6604c6d513bac4a7085
2017-11-03 19:10:04 +00:00
Jean-Michel Trivi
6fac7101c6 DO NOT MERGE Prevent out of bound memory access in GetInvInt
am: 070e7b81c0

Change-Id: Ibcddd5c0e53aaae0d26e1c33c6e42bc7268cf6a1
2017-11-03 19:10:04 +00:00
Jean-Michel Trivi
7462464e43 DO NOT MERGE Prevent out of bound memory access in GetInvInt
am: d0e8397b7b

Change-Id: If35860a327395c578e6f02b3706db0fd041e719e
2017-11-03 19:10:04 +00:00
Jean-Michel Trivi
2a7b438754 Fix out of bound memory access in lppTransposer
am: 6d3dd40e20

Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
2017-11-03 19:07:04 +00:00
Jean-Michel Trivi
5ce724f1dd DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
2017-11-02 18:55:37 +00:00
Jean-Michel Trivi
0d54662fe8 DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
2017-11-02 18:54:15 +00:00
Jean-Michel Trivi
3b6a14a1e0 DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
2017-11-02 18:52:41 +00:00
Jean-Michel Trivi
51f38b3a6d DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
2017-11-02 16:25:34 +00:00
Jean-Michel Trivi
6d3dd40e20 Fix out of bound memory access in lppTransposer
In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a
  reasonable value to guarantee correct termination in while loop
  in lppTransposer function. This fixes the reported bug.
For completeness:
  - clear the whole bwIndex array instead of noOfPatches entries only.
  - abort criterion in while loop to prevent potential
    infinite loop, and limit bwIndex[patch] to a valid range.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65280786

Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
2017-10-31 21:40:14 +00:00
Jean-Michel Trivi
070e7b81c0 DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
2017-10-30 22:46:18 +00:00
Jean-Michel Trivi
d0e8397b7b DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
2017-10-30 15:20:44 -07:00