aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJean-Michel Trivi <jmtrivi@google.com>2017-11-03 19:10:25 +0000
committerandroid-build-merger <android-build-merger@google.com>2017-11-03 19:10:25 +0000
commitfca10279378c5e92ba1fb26ea66651a68dad87e5 (patch)
tree3d84ce4793ebad93494c93f8524e91f57ad77ed1
parent7462464e432b8604cdad4d9187fca5e029326a8f (diff)
parent2a7b438754ca7d0ea3d98ca2c21a4e3d48e79241 (diff)
downloadfdk-aac-fca10279378c5e92ba1fb26ea66651a68dad87e5.tar.gz
fdk-aac-fca10279378c5e92ba1fb26ea66651a68dad87e5.tar.bz2
fdk-aac-fca10279378c5e92ba1fb26ea66651a68dad87e5.zip
Fix out of bound memory access in lppTransposer am: 6d3dd40e20
am: 2a7b438754 Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
-rw-r--r--libSBRdec/src/lpp_tran.cpp10
1 files changed, 7 insertions, 3 deletions
diff --git a/libSBRdec/src/lpp_tran.cpp b/libSBRdec/src/lpp_tran.cpp
index 117e739..343aec3 100644
--- a/libSBRdec/src/lpp_tran.cpp
+++ b/libSBRdec/src/lpp_tran.cpp
@@ -293,7 +293,7 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transp
}
/* init bwIndex for each patch */
- FDKmemclear(bwIndex, pSettings->noOfPatches*sizeof(INT));
+ FDKmemclear(bwIndex, MAX_NUM_PATCHES*sizeof(INT));
/*
Calc common low band scale factor
@@ -621,9 +621,9 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transp
FDK_ASSERT( hiBand < (64) );
/* bwIndex[patch] is already initialized with value from previous band inside this patch */
- while (hiBand >= pSettings->bwBorders[bwIndex[patch]])
+ while (hiBand >= pSettings->bwBorders[bwIndex[patch]] && bwIndex[patch] < MAX_NUM_PATCHES-1) {
bwIndex[patch]++;
-
+ }
/*
Filter Step 2: add the left slope with the current filter to the buffer
@@ -962,6 +962,10 @@ resetLppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transpos
for(i = 0 ; i < noNoiseBands; i++){
pSettings->bwBorders[i] = noiseBandTable[i+1];
}
+ for (;i < MAX_NUM_NOISE_VALUES; i++) {
+ pSettings->bwBorders[i] = 255;
+ }
+
/*
* Choose whitening factors