diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-09-09 22:02:14 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-09-09 22:02:14 +0000 |
| commit | 17dd8dfad975f1ab2fc4ec5c585cfbf4fe549af6 (patch) | |
| tree | 55a5550d56ced9d0e1f8c06b061077acd26df3e6 | |
| parent | 5def92cb0fa9284064890d9fe5cb0a54d9e03589 (diff) | |
| parent | c516539a202b08cda8569a9e58c9dc6097450cbe (diff) | |
| download | fdk-aac-17dd8dfad975f1ab2fc4ec5c585cfbf4fe549af6.tar.gz fdk-aac-17dd8dfad975f1ab2fc4ec5c585cfbf4fe549af6.tar.bz2 fdk-aac-17dd8dfad975f1ab2fc4ec5c585cfbf4fe549af6.zip | |
Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). am: c516539a20
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/12091300
Change-Id: I41058bf1a076509c564defa70247dcbfa91c64d0
| -rw-r--r-- | libSBRdec/src/sbrdecoder.cpp | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp index c827ced..58ab9a3 100644 --- a/libSBRdec/src/sbrdecoder.cpp +++ b/libSBRdec/src/sbrdecoder.cpp @@ -619,10 +619,6 @@ SBR_ERROR sbrDecoder_InitElement( self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels; } - /* Save element ID for sanity checks and to have a fallback for concealment. - */ - self->pSbrElement[elementIndex]->elementID = elementID; - /* Determine amount of channels for this element */ switch (elementID) { case ID_NONE: @@ -655,12 +651,16 @@ SBR_ERROR sbrDecoder_InitElement( } /* Sanity check to avoid memory leaks */ - if (elChannels < self->pSbrElement[elementIndex]->nChannels) { + if (elChannels < self->pSbrElement[elementIndex]->nChannels || + (self->numSbrChannels + elChannels) > (8) + (1)) { self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels; sbrError = SBRDEC_PARSE_ERROR; goto bail; } + /* Save element ID for sanity checks and to have a fallback for concealment. + */ + self->pSbrElement[elementIndex]->elementID = elementID; self->pSbrElement[elementIndex]->nChannels = elChannels; for (ch = 0; ch < elChannels; ch++) { |