diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-01-02 12:49:57 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-01-02 12:49:57 -0800 |
| commit | e8d354305f6a486d1abd142d292fd23b95fe1f5c (patch) | |
| tree | 0be53dcb304dddde84c65a7396173d88f6cf986f | |
| parent | dedce44ca873ceb1e4269c7427177da7a3110b8c (diff) | |
| parent | 8bdeed59aa956c50f5a70cfa7ea8a66b16278fe2 (diff) | |
| download | fdk-aac-e8d354305f6a486d1abd142d292fd23b95fe1f5c.tar.gz fdk-aac-e8d354305f6a486d1abd142d292fd23b95fe1f5c.tar.bz2 fdk-aac-e8d354305f6a486d1abd142d292fd23b95fe1f5c.zip | |
Merge changes I7add6dff,I0249f758 am: b42dfa745b
am: 8bdeed59aa
Change-Id: I335f3e5f617add8bdbfc6e5c0bb6a0eab80f4f9a
| -rw-r--r-- | libSACdec/src/sac_bitdec.cpp | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 159cf84..1049c3d 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -572,16 +572,18 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( numHeaderBits = cfgStartPos - (INT)FDKgetValidBits(bitstream); bitsAvailable -= numHeaderBits; + if (bitsAvailable < 0) { + err = MPS_PARSE_ERROR; + goto bail; + } pSpatialSpecificConfig->sacExtCnt = 0; pSpatialSpecificConfig->bResidualCoding = 0; - if ((err == MPS_OK) && (bitsAvailable > 0)) { - err = SpatialDecParseExtensionConfig( - bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, - pSpatialSpecificConfig->nTttBoxes, - pSpatialSpecificConfig->nOutputChannels, bitsAvailable); - } + err = SpatialDecParseExtensionConfig( + bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, + pSpatialSpecificConfig->nTttBoxes, + pSpatialSpecificConfig->nOutputChannels, bitsAvailable); FDKbyteAlign( bitstream, @@ -1868,6 +1870,16 @@ SACDEC_ERROR SpatialDecDecodeFrame(spatialDec *self, SPATIAL_BS_FRAME *frame) { frame->numParameterSets = fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1); frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1; + + for (int p = 0; p < frame->numParameterSets; p++) { + if (frame->paramSlot[p] > self->timeSlots - 1) { + frame->paramSlot[p] = self->timeSlots - 1; + err = MPS_PARSE_ERROR; + } + } + if (err != MPS_OK) { + goto bail; + } } bail: |