diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-11-13 16:08:09 +0100 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2020-01-16 12:15:04 -0800 |
| commit | e3b9058b8b72ccc890014c597b25a7cedfd555e3 (patch) | |
| tree | 954c4dfc3fbadfe83d6aec73aa1d6e4c2dad5a14 | |
| parent | 8fee7605df2d8759a63faa3d0b1aac7d95dfc1af (diff) | |
| download | fdk-aac-e3b9058b8b72ccc890014c597b25a7cedfd555e3.tar.gz fdk-aac-e3b9058b8b72ccc890014c597b25a7cedfd555e3.tar.bz2 fdk-aac-e3b9058b8b72ccc890014c597b25a7cedfd555e3.zip | |
Avoid unsigned integer overflows in FDK_Feed().
Bug: 146937030
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I7bd63c2fbfed2612c80d3334d1339e1cd215e034
| -rw-r--r-- | libFDK/src/FDK_bitbuffer.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libFDK/src/FDK_bitbuffer.cpp b/libFDK/src/FDK_bitbuffer.cpp index 98905ea..9b7f5b8 100644 --- a/libFDK/src/FDK_bitbuffer.cpp +++ b/libFDK/src/FDK_bitbuffer.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -368,7 +368,10 @@ void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer, UINT bTotal = 0; - UINT bToRead = (hBitBuf->bufBits - hBitBuf->ValidBits) >> 3; + UINT bToRead = + fMin(hBitBuf->bufBits, + (UINT)fMax(0, ((INT)hBitBuf->bufBits - (INT)hBitBuf->ValidBits))) >> + 3; UINT noOfBytes = fMin(bToRead, *bytesValid); //(bToRead < *bytesValid) ? bToRead : *bytesValid ; @@ -384,7 +387,7 @@ void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer, bToRead * sizeof(UCHAR)); /* add noOfBits to number of valid bits in buffer */ - hBitBuf->ValidBits += bToRead << 3; + hBitBuf->ValidBits = (UINT)((INT)hBitBuf->ValidBits + (INT)(bToRead << 3)); bTotal += bToRead; inputBuffer += bToRead; |