diff options
| author | Treehugger Robot <treehugger-gerrit@google.com> | 2019-01-02 20:33:56 +0000 |
|---|---|---|
| committer | Gerrit Code Review <noreply-gerritcodereview@google.com> | 2019-01-02 20:33:56 +0000 |
| commit | b42dfa745b8159ab12b9720f409776cde466d6ec (patch) | |
| tree | 75a7e33f1daae846b566295d979091cce236e17d | |
| parent | 0142f389049f4f291908af7812d83d959ea52b48 (diff) | |
| parent | f440f28aa3cfa02d52abb89e7db24d16f6eb0172 (diff) | |
| download | fdk-aac-b42dfa745b8159ab12b9720f409776cde466d6ec.tar.gz fdk-aac-b42dfa745b8159ab12b9720f409776cde466d6ec.tar.bz2 fdk-aac-b42dfa745b8159ab12b9720f409776cde466d6ec.zip | |
Merge changes I7add6dff,I0249f758
* changes:
Return SpatialDecDecodeFrame() parse error in case extended frame does not match the spatial frame
Add sanity check in SpatialDecParseSpecificConfig()
| -rw-r--r-- | libSACdec/src/sac_bitdec.cpp | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 159cf84..1049c3d 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -572,16 +572,18 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( numHeaderBits = cfgStartPos - (INT)FDKgetValidBits(bitstream); bitsAvailable -= numHeaderBits; + if (bitsAvailable < 0) { + err = MPS_PARSE_ERROR; + goto bail; + } pSpatialSpecificConfig->sacExtCnt = 0; pSpatialSpecificConfig->bResidualCoding = 0; - if ((err == MPS_OK) && (bitsAvailable > 0)) { - err = SpatialDecParseExtensionConfig( - bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, - pSpatialSpecificConfig->nTttBoxes, - pSpatialSpecificConfig->nOutputChannels, bitsAvailable); - } + err = SpatialDecParseExtensionConfig( + bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, + pSpatialSpecificConfig->nTttBoxes, + pSpatialSpecificConfig->nOutputChannels, bitsAvailable); FDKbyteAlign( bitstream, @@ -1868,6 +1870,16 @@ SACDEC_ERROR SpatialDecDecodeFrame(spatialDec *self, SPATIAL_BS_FRAME *frame) { frame->numParameterSets = fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1); frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1; + + for (int p = 0; p < frame->numParameterSets; p++) { + if (frame->paramSlot[p] > self->timeSlots - 1) { + frame->paramSlot[p] = self->timeSlots - 1; + err = MPS_PARSE_ERROR; + } + } + if (err != MPS_OK) { + goto bail; + } } bail: |