diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-09-09 21:54:26 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-09-09 21:54:26 +0000 |
| commit | 11b611293f0d7bffeae3f58dba57604f9eb52cf0 (patch) | |
| tree | 53705cee093f9ffd9699c4b1b8d07e546717d9ae | |
| parent | 3f82e7e794466e1204c03a12dbf22da7cfb5f854 (diff) | |
| parent | a5a3ef611ce4ff8b6f8ad0ad54a4e1029deb3284 (diff) | |
| download | fdk-aac-11b611293f0d7bffeae3f58dba57604f9eb52cf0.tar.gz fdk-aac-11b611293f0d7bffeae3f58dba57604f9eb52cf0.tar.bz2 fdk-aac-11b611293f0d7bffeae3f58dba57604f9eb52cf0.zip | |
Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). am: bb8f983bf3 am: f007f6a4bc am: a5a3ef611c
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/12087395
Change-Id: I19cbfb6b908a878ce59e8c6869ba9c5957d10075
| -rw-r--r-- | libSBRdec/src/sbrdecoder.cpp | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp index b51461d..b101a4a 100644 --- a/libSBRdec/src/sbrdecoder.cpp +++ b/libSBRdec/src/sbrdecoder.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -617,10 +617,6 @@ SBR_ERROR sbrDecoder_InitElement( self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels; } - /* Save element ID for sanity checks and to have a fallback for concealment. - */ - self->pSbrElement[elementIndex]->elementID = elementID; - /* Determine amount of channels for this element */ switch (elementID) { case ID_NONE: @@ -653,12 +649,16 @@ SBR_ERROR sbrDecoder_InitElement( } /* Sanity check to avoid memory leaks */ - if (elChannels < self->pSbrElement[elementIndex]->nChannels) { + if (elChannels < self->pSbrElement[elementIndex]->nChannels || + (self->numSbrChannels + elChannels) > (8) + (1)) { self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels; sbrError = SBRDEC_PARSE_ERROR; goto bail; } + /* Save element ID for sanity checks and to have a fallback for concealment. + */ + self->pSbrElement[elementIndex]->elementID = elementID; self->pSbrElement[elementIndex]->nChannels = elChannels; for (ch = 0; ch < elChannels; ch++) { |