diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2018-06-29 16:34:55 +0200 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2018-12-26 19:45:18 -0500 |
| commit | 950d8efb1a0562d1402b6c3379db4e17d71c7578 (patch) | |
| tree | b9cb14f1472572b3907379571a86d9808fc0d93d /libAACdec/src/aacdec_hcrs.cpp | |
| parent | f59fd73d4443b015b11a362c807f6b828658a799 (diff) | |
| download | fdk-aac-950d8efb1a0562d1402b6c3379db4e17d71c7578.tar.gz fdk-aac-950d8efb1a0562d1402b6c3379db4e17d71c7578.tar.bz2 fdk-aac-950d8efb1a0562d1402b6c3379db4e17d71c7578.zip | |
Unsigned Integer Overflow in InitSegmentBitfield()
Bug: 112662995
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Ida3b1d49dc35a03a3ff02f6e150cfb55e9e1da11
Diffstat (limited to 'libAACdec/src/aacdec_hcrs.cpp')
| -rw-r--r-- | libAACdec/src/aacdec_hcrs.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp index 1d5aa27..d2bc867 100644 --- a/libAACdec/src/aacdec_hcrs.cpp +++ b/libAACdec/src/aacdec_hcrs.cpp @@ -367,7 +367,10 @@ static UINT InitSegmentBitfield(UINT *pNumSegment, UINT tempWord; USHORT numValidSegment; - *pNumWordForBitfield = ((*pNumSegment - 1) >> THIRTYTWO_LOG_DIV_TWO_LOG) + 1; + *pNumWordForBitfield = + (*pNumSegment == 0) + ? 0 + : ((*pNumSegment - 1) >> THIRTYTWO_LOG_DIV_TWO_LOG) + 1; /* loop over all words, which are completely used or only partial */ /* bit in pSegmentBitfield is zero if segment is empty; bit in |