diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-01-02 12:46:02 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-01-02 12:46:02 -0800 |
| commit | 8bdeed59aa956c50f5a70cfa7ea8a66b16278fe2 (patch) | |
| tree | 75a7e33f1daae846b566295d979091cce236e17d | |
| parent | 0ef6247c4f898e9259872d3565a604d7bebbf36d (diff) | |
| parent | b42dfa745b8159ab12b9720f409776cde466d6ec (diff) | |
| download | fdk-aac-8bdeed59aa956c50f5a70cfa7ea8a66b16278fe2.tar.gz fdk-aac-8bdeed59aa956c50f5a70cfa7ea8a66b16278fe2.tar.bz2 fdk-aac-8bdeed59aa956c50f5a70cfa7ea8a66b16278fe2.zip | |
Merge changes I7add6dff,I0249f758
am: b42dfa745b
Change-Id: I7c8544215b13db8440c4a72671996da0fac3be2e
| -rw-r--r-- | libSACdec/src/sac_bitdec.cpp | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 159cf84..1049c3d 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -572,16 +572,18 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( numHeaderBits = cfgStartPos - (INT)FDKgetValidBits(bitstream); bitsAvailable -= numHeaderBits; + if (bitsAvailable < 0) { + err = MPS_PARSE_ERROR; + goto bail; + } pSpatialSpecificConfig->sacExtCnt = 0; pSpatialSpecificConfig->bResidualCoding = 0; - if ((err == MPS_OK) && (bitsAvailable > 0)) { - err = SpatialDecParseExtensionConfig( - bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, - pSpatialSpecificConfig->nTttBoxes, - pSpatialSpecificConfig->nOutputChannels, bitsAvailable); - } + err = SpatialDecParseExtensionConfig( + bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, + pSpatialSpecificConfig->nTttBoxes, + pSpatialSpecificConfig->nOutputChannels, bitsAvailable); FDKbyteAlign( bitstream, @@ -1868,6 +1870,16 @@ SACDEC_ERROR SpatialDecDecodeFrame(spatialDec *self, SPATIAL_BS_FRAME *frame) { frame->numParameterSets = fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1); frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1; + + for (int p = 0; p < frame->numParameterSets; p++) { + if (frame->paramSlot[p] > self->timeSlots - 1) { + frame->paramSlot[p] = self->timeSlots - 1; + err = MPS_PARSE_ERROR; + } + } + if (err != MPS_OK) { + goto bail; + } } bail: |