diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-01-02 12:54:01 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-01-02 12:54:01 -0800 |
| commit | 37492f80b12192ef4d0063b623a5c70c8359b69c (patch) | |
| tree | 38fc11fcb9ec20d19fd367431a11e6c269930604 | |
| parent | 907ffbf69d29ee8a3b7a0e614118d2a07c6372d7 (diff) | |
| parent | e8d354305f6a486d1abd142d292fd23b95fe1f5c (diff) | |
| download | fdk-aac-37492f80b12192ef4d0063b623a5c70c8359b69c.tar.gz fdk-aac-37492f80b12192ef4d0063b623a5c70c8359b69c.tar.bz2 fdk-aac-37492f80b12192ef4d0063b623a5c70c8359b69c.zip | |
Merge changes I7add6dff,I0249f758 am: b42dfa745b am: 8bdeed59aa
am: e8d354305f
Change-Id: I7a8cf34b4af1234e412c346ba1c0610f047360d9
| -rw-r--r-- | libSACdec/src/sac_bitdec.cpp | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 159cf84..1049c3d 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -572,16 +572,18 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( numHeaderBits = cfgStartPos - (INT)FDKgetValidBits(bitstream); bitsAvailable -= numHeaderBits; + if (bitsAvailable < 0) { + err = MPS_PARSE_ERROR; + goto bail; + } pSpatialSpecificConfig->sacExtCnt = 0; pSpatialSpecificConfig->bResidualCoding = 0; - if ((err == MPS_OK) && (bitsAvailable > 0)) { - err = SpatialDecParseExtensionConfig( - bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, - pSpatialSpecificConfig->nTttBoxes, - pSpatialSpecificConfig->nOutputChannels, bitsAvailable); - } + err = SpatialDecParseExtensionConfig( + bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, + pSpatialSpecificConfig->nTttBoxes, + pSpatialSpecificConfig->nOutputChannels, bitsAvailable); FDKbyteAlign( bitstream, @@ -1868,6 +1870,16 @@ SACDEC_ERROR SpatialDecDecodeFrame(spatialDec *self, SPATIAL_BS_FRAME *frame) { frame->numParameterSets = fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1); frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1; + + for (int p = 0; p < frame->numParameterSets; p++) { + if (frame->paramSlot[p] > self->timeSlots - 1) { + frame->paramSlot[p] = self->timeSlots - 1; + err = MPS_PARSE_ERROR; + } + } + if (err != MPS_OK) { + goto bail; + } } bail: |