diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-07-06 16:37:38 +0200 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2020-09-16 23:28:22 +0000 |
| commit | ffff95538e9994d312ffdfbba94d88ed226ef7bf (patch) | |
| tree | ed2dba14aa6b7c124a03467ed4b5679b14f2f648 /libAACdec | |
| parent | 63d6409af12c87e7350cf00cd30f60d362bf3311 (diff) | |
| download | fdk-aac-ffff95538e9994d312ffdfbba94d88ed226ef7bf.tar.gz fdk-aac-ffff95538e9994d312ffdfbba94d88ed226ef7bf.tar.bz2 fdk-aac-ffff95538e9994d312ffdfbba94d88ed226ef7bf.zip | |
Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.
Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Change-Id: I0150ac6d5a47ffce883010f531928656eebc619e
Merged-In: I0150ac6d5a47ffce883010f531928656eebc619e
(cherry picked from commit bb8f983bf36ee2ad8af6acebf4823a58060004ab)
Diffstat (limited to 'libAACdec')
0 files changed, 0 insertions, 0 deletions