fdk-aac/libSBRdec/src
Fraunhofer IIS FDK b5dfe8f92d Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.

Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Change-Id: I0150ac6d5a47ffce883010f531928656eebc619e
2020-08-10 19:57:03 +00:00
..
arm Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
HFgen_preFlat.cpp Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0). 2020-02-14 10:53:51 -08:00
HFgen_preFlat.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
env_calc.cpp Avoid too large shift exponent in apply_inter_tes() by using fIsLessThan. 2020-01-16 12:15:04 -08:00
env_calc.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
env_dec.cpp Fix potential invalid memory access for concealment in decodeEnvelope() 2018-12-27 17:28:39 -05:00
env_dec.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
env_extr.cpp libSBRdec: prevent OOB access 2019-03-07 14:16:05 -08:00
env_extr.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
hbe.cpp Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0). 2020-02-14 10:53:51 -08:00
hbe.h Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0). 2020-02-14 10:53:51 -08:00
huff_dec.cpp Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
huff_dec.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
lpp_tran.cpp Adjust scaling in lppTransposerHBE() to prevent signed integer overflow in autocorrelation. 2019-12-27 10:20:36 -08:00
lpp_tran.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
psbitdec.cpp Extend PS concealment/error treatment 2018-12-27 17:31:46 -05:00
psbitdec.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
psdec.cpp Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
psdec.h Extend PS concealment/error treatment 2018-12-27 17:31:46 -05:00
psdec_drm.cpp Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
psdec_drm.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
psdecrom_drm.cpp Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
pvc_dec.cpp Fix signed integer overflow in pvcDecodeTimeSlot(). 2019-12-27 08:54:50 -08:00
pvc_dec.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbr_deb.cpp Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbr_deb.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbr_dec.cpp Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0). 2020-02-14 10:53:51 -08:00
sbr_dec.h Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0). 2020-02-14 10:53:51 -08:00
sbr_ram.cpp Revise memory overlay usage and remove deprecated buffers and overlay tags. 2020-02-14 10:44:10 -08:00
sbr_ram.h Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0). 2020-02-14 10:53:51 -08:00
sbr_rom.cpp Improve random phase table accuracy. 2019-05-14 14:13:38 -07:00
sbr_rom.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbrdec_drc.cpp Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbrdec_drc.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbrdec_freq_sca.cpp Fix signed integer overflow in calcFactorPerBand() calculation. 2019-10-18 10:56:10 -07:00
sbrdec_freq_sca.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00
sbrdecoder.cpp Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). 2020-08-10 19:57:03 +00:00
transcendent.h Upgrade to FDKv2 2018-04-19 11:21:15 -07:00