diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-07-06 12:28:12 -0700 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2020-07-06 21:42:07 +0000 |
| commit | 50aa5be38870319395ce2ef6f91543e6475e4b97 (patch) | |
| tree | 04c36149d3286cefd3fb5607e9c2130044f959f8 /NOTICE | |
| parent | 5a025c4fea7911e913af8f3f115efda256447762 (diff) | |
| download | fdk-aac-50aa5be38870319395ce2ef6f91543e6475e4b97.tar.gz fdk-aac-50aa5be38870319395ce2ef6f91543e6475e4b97.tar.bz2 fdk-aac-50aa5be38870319395ce2ef6f91543e6475e4b97.zip | |
[DO NOT MERGE] Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.
Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestXheAac
Change-Id: I741f49ab3b675fa3d3217ee72e1db66b0114f7ee
Diffstat (limited to 'NOTICE')
0 files changed, 0 insertions, 0 deletions