diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2017-10-30 14:07:07 -0700 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2017-10-30 22:45:05 +0000 |
| commit | 76c4625fe3c1cfcb0a493b8df418cc86c294160f (patch) | |
| tree | 9ea89483973e0bc7f119400028131d8ace7c37dd /libFDK/include/fixpoint_math.h | |
| parent | 78653b30e9c1907d4c6eefa30ff954e0c4398447 (diff) | |
| download | fdk-aac-76c4625fe3c1cfcb0a493b8df418cc86c294160f.tar.gz fdk-aac-76c4625fe3c1cfcb0a493b8df418cc86c294160f.tar.bz2 fdk-aac-76c4625fe3c1cfcb0a493b8df418cc86c294160f.zip | |
DO NOT MERGE Prevent out of bound memory access in GetInvInt
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
Diffstat (limited to 'libFDK/include/fixpoint_math.h')
| -rw-r--r-- | libFDK/include/fixpoint_math.h | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/libFDK/include/fixpoint_math.h b/libFDK/include/fixpoint_math.h index df141d3..26c001f 100644 --- a/libFDK/include/fixpoint_math.h +++ b/libFDK/include/fixpoint_math.h @@ -450,15 +450,19 @@ inline FIXP_DBL fAddSaturate(const FIXP_DBL a, const FIXP_DBL b) /** * \brief Calculate the value of 1/i where i is a integer value. It supports - * input values from 1 upto 50. + * input values from 0 upto 49. * \param intValue Integer input value. * \param FIXP_DBL representation of 1/intValue */ inline FIXP_DBL GetInvInt(int intValue) { - FDK_ASSERT((intValue > 0) && (intValue < 50)); - FDK_ASSERT(intValue<50); - return invCount[intValue]; + FDK_ASSERT((intValue >= 0) && (intValue < 50)); + if (intValue < 0) + return invCount[0]; + else if (intValue > 49) + return invCount[49]; + else + return invCount[intValue]; } |